The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Critical Vulnerability in ABB's PPT30 Operating System: CVE-2025-11482
On May 26, 2026, ABB disclosed a vulnerability (CVE-2025-11482) in its PPT30 Operating System versions prior to 1.8.0. This flaw resides in the OPC-UA Server component, where an unauthenticated attacker can exploit resource allocation issues to cause a denial-of-service condition, rendering the server unresponsive and disrupting industrial control processes. The vulnerability has a CVSS v3.1 base score of 7.5, indicating a high severity level. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-11482?utm_source=openai)) The disclosure underscores the critical need for timely patching in industrial control systems to prevent potential operational disruptions. Organizations are advised to upgrade to version 1.8.0 or later and implement network segmentation to mitigate risks associated with this vulnerability. ([feed.craftedsignal.io](https://feed.craftedsignal.io/briefs/2026-05-abb-ppt30-cve-2025-11482/?utm_source=openai))
3 months ago
Kill Chain
Critical Vulnerabilities in Hitachi Energy's ITT600 Explorer: CVE-2024-8176 and CVE-2025-59375
In May 2026, Hitachi Energy disclosed two critical vulnerabilities in its ITT600 Explorer product, identified as CVE-2024-8176 and CVE-2025-59375. These vulnerabilities stem from issues within the libexpat library used by the product's IEC61850 functionality. CVE-2024-8176 involves a stack overflow due to improper restriction of XML entity expansion depth, potentially leading to denial of service (DoS) or memory corruption. CVE-2025-59375 allows attackers to trigger large dynamic memory allocations via small, crafted XML documents, also resulting in DoS conditions. Both vulnerabilities affect ITT600 Explorer versions prior to 2.1 SP6. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2024-8176?utm_source=openai)) The disclosure underscores the critical importance of securing components within industrial control systems, especially those handling XML parsing. Given the widespread use of libexpat across various applications, these vulnerabilities highlight the necessity for organizations to promptly update affected systems to mitigate potential exploitation risks.
3 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy's MACH HiDraw: CVE-2026-7310
In May 2026, a heap-based buffer overflow vulnerability (CVE-2026-7310) was identified in the XML parser functionality of Hitachi Energy's MACH HiDraw versions up to 9.22. An authenticated user with local access could exploit this flaw using a specially crafted XML file, leading to memory corruption and potential arbitrary code execution. Successful exploitation could result in application crashes (denial of service) and compromise the confidentiality and integrity of the affected system. This incident underscores the critical importance of securing industrial control systems against local threats. As cyberattacks targeting infrastructure components become more sophisticated, organizations must prioritize timely vulnerability management and implement robust security measures to protect against potential exploits.
3 months ago
Kill Chain
Anthropic's Project Glasswing Expands to Strengthen Global Cybersecurity
In April 2026, Anthropic launched Project Glasswing, granting approximately 50 organizations access to its advanced AI model, Claude Mythos Preview, to identify software vulnerabilities. By June 2026, the initiative expanded to include around 150 additional organizations across 15 countries, focusing on critical infrastructure sectors such as power, water, healthcare, communications, and hardware. The model has uncovered over 10,000 high- or critical-severity vulnerabilities, with partners like Cloudflare and Mozilla reporting significant increases in bug discovery rates. The rapid identification of vulnerabilities has shifted the cybersecurity landscape, highlighting challenges in verifying, disclosing, and patching flaws before exploitation. A joint report from the Cloud Security Alliance, the SANS Institute, and OWASP warns that organizations may be overwhelmed by threat actors using AI to exploit vulnerabilities faster than defenders can address them.
3 months ago
Kill Chain
Polish Water Treatment Plant Breach: A Wake-Up Call for Critical Infrastructure Security
Between 2024 and 2025, Poland's Internal Security Agency (ABW) reported that state-sponsored threat actors, including APT28 and APT29, infiltrated industrial control systems (ICS) at five municipal water treatment facilities. The attackers exploited weak passwords and internet-exposed systems, gaining the capability to manipulate operational parameters, potentially compromising water quality and public safety. This breach underscores the critical vulnerabilities in essential infrastructure and the pressing need for robust cybersecurity measures. The incident highlights a growing trend of cyberattacks targeting operational technology (OT) systems within critical infrastructure sectors. As adversaries increasingly focus on these sectors, organizations must prioritize securing OT environments to prevent potential disruptions and safeguard public health.
3 months ago
Kill Chain
Dutch Authorities' Raid on Russian Bulletproof Host Fails to Disrupt Cyber Activities
In May 2026, Dutch authorities seized over 800 servers and arrested two individuals associated with THE.Hosting, a bulletproof hosting service linked to Russian cybercriminal activities. Despite these efforts, the network's malicious operations, including broad scanning and botnet-building, continued largely unaffected due to the resilience of its infrastructure and the retention of its core IP address space. ([darkreading.com](https://www.darkreading.com/cyber-risk/dutch-raid-russian-bulletproof-host?utm_source=openai)) This incident underscores the challenges law enforcement faces in disrupting sophisticated cybercriminal networks that can rapidly adapt and reconstitute their operations, highlighting the need for coordinated international efforts and more comprehensive strategies to effectively combat such threats.
3 months ago
Kill Chain
Critical Security Flaws Discovered in XCharge C6 EV Chargers
In May 2026, multiple critical vulnerabilities were identified in XCharge's C6 electric vehicle charging controllers, including CVE-2026-9037, CVE-2026-9038, and CVE-2026-9039. These flaws could allow attackers to gain administrative rights or execute unauthorized code on affected devices. The vulnerabilities encompass issues such as unverified firmware updates, stack-based buffer overflows, and insecure default configurations. Exploitation of these vulnerabilities could lead to significant control over critical infrastructure in transportation systems worldwide. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-xcharge-c6-ev-chargers-have-3-critical-flaws-cvss-9-8.420545/?utm_source=openai)) The increasing integration of IoT devices in critical infrastructure highlights the urgency of addressing such vulnerabilities. Ensuring robust security measures and timely updates is essential to prevent potential disruptions and maintain the integrity of essential services.
3 months ago
Kill Chain
Critical Security Flaw in Jinan USR IOT's USR-W610 Converter Exposes Networks to Attack
In May 2026, a critical vulnerability (CVE-2026-7786) was identified in Jinan USR IOT Technology Limited's USR-W610 RS232/485 to Wi-Fi/Ethernet Converter, firmware version 7.03T.07. The device contains hard-coded plaintext administrative credentials embedded within the firmware, which can be extracted and used by attackers to gain full administrator access. This flaw poses significant risks, including unauthorized control over the device and potential network intrusion. The vendor has not responded to coordination attempts, leaving users without an official patch or remediation guidance. This incident underscores the persistent issue of hard-coded credentials in IoT devices, a vulnerability that has been exploited in various sectors, leading to unauthorized access and control. The lack of vendor response highlights the challenges in securing IoT devices, emphasizing the need for proactive security measures and regular vulnerability assessments to mitigate such risks.
3 months ago
Kill Chain
Schneider Electric's EcoStruxure Machine Expert HVAC Vulnerability: CVE-2026-6332
In May 2026, Schneider Electric disclosed a vulnerability (CVE-2026-6332) in its EcoStruxure Machine Expert HVAC software versions prior to 1.10.0. This flaw involves the cleartext storage of sensitive information, potentially exposing protected source code when accessed by authorized users for editing or compiling. Such exposure could lead to a loss of confidentiality and unauthorized disclosure of proprietary logic and operational details. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-6332?utm_source=openai)) This incident underscores the critical importance of securing engineering workstations and programming environments in industrial settings. As industrial control systems become increasingly interconnected, ensuring the confidentiality and integrity of source code is paramount to prevent potential reconnaissance and exploitation by malicious actors.
3 months ago
Kill Chain
Critical Vulnerability in ABB EIBPORT Devices Disclosed
In May 2026, ABB disclosed a critical vulnerability in its EIBPORT V3 KNX and KNX GSM devices, versions prior to 3.9.2. The flaw, identified as CVE-2021-22291, is a cross-site scripting (XSS) vulnerability that could allow attackers to access sensitive information and alter device configurations. ABB has released firmware updates to address this issue and recommends immediate application to mitigate potential risks. This incident underscores the persistent threat of web-based vulnerabilities in industrial control systems, emphasizing the need for continuous monitoring and timely patch management to protect critical infrastructure from evolving cyber threats.
3 months ago
Kill Chain
Enhancing Industrial Security: AI-Assisted Sparkplug B Protocol Fuzzer Released
In May 2026, Bishop Fox released a security fuzzer for the Sparkplug B protocol, a dominant MQTT-based protocol in industrial control and SCADA environments. This tool systematically tests all nine message types, 19 data types, and over 87 unique field paths defined by the Eclipse Sparkplug specification. The fuzzer was developed with AI assistance, specifically utilizing Claude Code to identify coverage gaps and Python defects, resulting in a hardened, self-contained tool with CLI, logging, and passive network discovery capabilities. This development is crucial for ICS and SCADA operators, device vendors, and defenders, as it enables the identification of crashes, protocol violations, and state-handling bugs in Sparkplug B endpoints before attackers can exploit them. The tool is available on GitHub for immediate use.
4 months ago
Kill Chain
Critical DoS Vulnerability in ABB B&R Automation Runtime (CVE-2025-3450)
In October 2025, ABB identified a critical vulnerability (CVE-2025-3450) in the System Diagnostics Manager (SDM) component of B&R Automation Runtime versions prior to 6.3 and Q4.93. This flaw allows unauthenticated, network-based attackers to delete data, leading to denial-of-service conditions. The vulnerability stems from improper resource locking within the SDM, potentially causing affected systems to cease operation upon exploitation. ABB has released updates to address this issue and recommends users upgrade to Automation Runtime versions 6.3 or Q4.93 to mitigate the risk. This incident underscores the importance of timely patch management and robust network security practices, especially in critical infrastructure sectors where such vulnerabilities can have significant operational impacts.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports