Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now
Executive Summary
In October 2026, CISA published ICS Advisory ICSA-26-288-01 disclosing six critical-to-high severity vulnerabilities in Eclipse Foundation Eclipse Milo, the widely deployed open-source OPC UA SDK used across chemical, energy, critical manufacturing, and water sectors worldwide. Flaws span incorrect authorization (CVE-2026-62927), missing authorization on diagnostics nodes (CVE-2026-63248, CVE-2026-58080), a padding-oracle attack enabling credential recovery (CVE-2026-60007), and two resource-exhaustion denial-of-service bugs (CVE-2026-63252, CVE-2026-61387). Unauthenticated remote attackers can delete protected OT data, impersonate legitimate users, or crash OPC UA servers entirely. The Eclipse Foundation has released version 1.1.5 as the remediation.
These vulnerabilities underscore a systemic risk in ICS/OT environments: open-source protocol libraries embedded deep in industrial control stacks often escape rigorous security review cycles. As OPC UA adoption accelerates for Industry 4.0 connectivity, authorization bypasses and cryptographic weaknesses in foundational SDKs present nation-state and ransomware actors with high-value, low-friction entry points into operational technology networks.
Why This Matters Now
OPC UA has become the de facto machine-to-machine communication standard for smart manufacturing and critical infrastructure. With six simultaneous CVEs—including a padding-oracle that recovers plaintext credentials and a missing-RoleMapper flaw granting anonymous access to protected nodes—unpatched Eclipse Milo deployments are exposed to credential theft and unauthorized command execution right now. CISA's global deployment warning and the absence of a 0.6.x backport make forced migration to 1.1.5 urgent for every affected operator.
Attack Path Analysis
An unauthenticated remote attacker targets an internet-exposed Eclipse Milo OPC UA server (versions 0.6.0–1.1.4) by exploiting missing authorization and observable response discrepancy vulnerabilities to enumerate session metadata, recover user credentials via a padding oracle attack (CVE-2026-60007), and authenticate as a legitimate user. With valid credentials, the attacker abuses authorization bypass flaws (CVE-2026-62927, CVE-2026-58080) to escalate effective permissions, execute protected methods, delete protected nodes, and read sensitive diagnostic data. Lateral movement within the ICS network is facilitated by the attacker's now-legitimate session context, while resource exhaustion CVEs (CVE-2026-63252, CVE-2026-61387) are leveraged as denial-of-service mechanisms to disrupt monitoring and cover tracks, ultimately causing operational disruption to critical infrastructure sectors including Chemical, Energy, and Water and Wastewater.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An unauthenticated attacker discovers an internet- or network-exposed Eclipse Milo OPC UA server endpoint. By connecting to a None/None endpoint without a certificate (CVE-2026-63248), the attacker enables diagnostics and reads security diagnostics nodes, exposing session usernames, authentication mechanisms, security policies, and public client certificates. Concurrently, the attacker initiates repeated unauthenticated ActivateSession requests to exploit the RSA PKCS#1 v1.5 padding oracle in username-token processing (CVE-2026-60007), leveraging distinguishable error responses to recover a victim user's password and obtain valid credentials.
Related CVEs
CVE-2026-62927
CVSS 7.5In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or low-privileged client to execute a denied method by batching it with an allowed method, resulting in incorrect authorization bypass.
Affected Products:
Eclipse Foundation Eclipse Milo – >=1.0.0, <=1.1.4
Exploit Status:
no public exploitCVE-2026-63252
CVSS 7.5In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.
Affected Products:
Eclipse Foundation Eclipse Milo – >=0.6.0, <=1.1.4
Exploit Status:
no public exploitCVE-2026-58080
CVSS 8.2In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper, causing sessions to receive no role IDs and the default access controller to skip role-permission checks, allowing an anonymous client to read role-permission metadata, invoke protected methods, or delete protected nodes.
Affected Products:
Eclipse Foundation Eclipse Milo – >=1.0.0, <=1.1.4
Exploit Status:
no public exploitCVE-2026-63248
CVSS 6.5In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization, allowing an anonymous client to enable diagnostics over a None/None endpoint and a trusted client to read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes, and public client certificates.
Affected Products:
Eclipse Foundation Eclipse Milo – >=0.6.0, <=1.1.4
Exploit Status:
no public exploitCVE-2026-60007
CVSS 7.4In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding versus other authentication failures, enabling an on-path attacker to use repeated unauthenticated ActivateSession requests as a padding oracle to recover a victim's password and impersonate the victim.
Affected Products:
Eclipse Foundation Eclipse Milo – >=0.6.0, <=1.1.4
Exploit Status:
no public exploitCVE-2026-61387
CVSS 7.5In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe; deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until server restart.
Affected Products:
Eclipse Foundation Eclipse Milo – >=1.0.0, <=1.1.4
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Abuse Elevation Control Mechanism
Brute Force
Unsecured Credentials
Endpoint Denial of Service
Data Destruction
Valid Accounts
Network Sniffing
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Access Enforcement
Control ID: AC-3
CISA Zero Trust Maturity Model 2.0 – Continuous Authorization Validation
Control ID: Identity Pillar – Authorization
NIS2 Directive – Access Control and Authentication Security
Control ID: Article 21 – Cybersecurity Risk Management Measures
IEC 62443-3-3 – OT Authentication and Session Security
Control ID: SR 1.1 – Human User Identification and Authentication
DORA (Digital Operational Resilience Act) – ICT Asset Vulnerability and Patch Management
Control ID: Article 9 – ICT Security Policies and Procedures
PCI DSS 4.0 – Vulnerability Identification and Remediation
Control ID: Requirement 6.3 – Security Vulnerabilities are Identified and Addressed
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Oil/Energy/Solar/Greentech
Eclipse Milo OPC UA ICS/OT vulnerabilities expose energy sector SCADA systems to unauthenticated privilege escalation, credential theft via padding oracle attacks, and server DoS through memory exhaustion.
Chemicals
CISA-designated critical infrastructure chemical facilities using Eclipse Milo OPC UA face missing authorization flaws enabling anonymous clients to delete protected nodes and invoke protected industrial control methods.
Utilities
Water, wastewater, and utility ICS deployments running Eclipse Milo versions 0.6.0–1.1.4 risk monitored-item quota exhaustion and session credential exposure, threatening operational continuity across distributed control systems.
Industrial Automation
Eclipse Milo OPC UA server vulnerabilities including incorrect authorization and observable response discrepancy directly compromise industrial automation OT environments requiring lateral movement controls and zero trust segmentation.
Sources
- Eclipse Foundation Eclipse Milohttps://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01Verified
- Eclipse Milo v1.1.5 Release Notes - GitHubhttps://github.com/eclipse-milo/milo/releases/tag/v1.1.5Verified
- Eclipse Milo OPC UA SDK - Eclipse Foundation Project Pagehttps://projects.eclipse.org/projects/iot.miloVerified
- CISA ICS Security Recommended Practiceshttps://www.cisa.gov/topics/industrial-control-systemsVerified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker's entire chain depends on unrestricted network reachability to an exposed OPC UA server and the ability to move freely across a flat ICS environment. By enforcing micro-segmentation and identity-aware access policies around OT workloads, CNSF would likely reduce the attacker's initial reach and constrain the blast radius across connected control system assets.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Unrestricted inbound access to the OPC UA endpoint would likely be constrained, reducing the attacker's ability to reach the vulnerable service from untrusted network origins and limiting the attack surface available for unauthenticated enumeration and credential recovery attempts.
Control: Zero Trust Segmentation
Mitigation: Even after credential recovery, Zero Trust segmentation would likely constrain the scope of what the attacker's session could reach within the environment, reducing the effective privilege surface available across workloads and limiting how far unauthorized method calls could propagate beyond the initially compromised server.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to pivot freely between OPC UA servers and ICS endpoints within the same segment, reducing the number of reachable control system assets and limiting how far harvested session context could be reused across the network.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility across traffic flows would likely surface anomalous OPC UA session patterns and unexpected communication volumes, reducing the attacker's ability to maintain an undetected persistent channel and constraining the scope of covert activity that could go unnoticed within normal ICS traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement would likely reduce the attacker's ability to move harvested OT data and credential material out of the ICS environment toward external infrastructure, constraining the outbound paths available for exfiltration and limiting what can successfully leave the protected network segment.
If prior CNSF controls had constrained reachability and lateral movement, the attacker's ability to execute destructive method calls and resource exhaustion attacks across multiple OPC UA servers and connected sector assets would likely be reduced to a smaller subset of the environment, limiting the operational disruption to fewer nodes rather than the full scope of deployed infrastructure.
Impact at a Glance
Affected Business Functions
- Industrial Control System (ICS) OPC UA Server Operations
- SCADA and Process Automation Data Telemetry
- Critical Infrastructure Monitoring and Control (Chemical, Energy, Water/Wastewater, Manufacturing)
- OT Network Authentication and Access Control
Estimated downtime: 3 days
Estimated loss: N/A
Exploitation of these vulnerabilities in ICS/OT environments could expose OPC UA session metadata including usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. A padding oracle attack (CVE-2026-60007) could allow full credential recovery and session impersonation. Authorization bypass flaws (CVE-2026-58080, CVE-2026-62927) could allow deletion of protected OPC UA nodes and unauthorized invocation of restricted methods. Memory exhaustion vulnerabilities (CVE-2026-63252, CVE-2026-61387) could cause denial of service, preventing all clients from communicating with affected OPC UA servers deployed in chemical, energy, manufacturing, and water/wastewater critical infrastructure sectors worldwide.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation and East-West Traffic Security controls to isolate OPC UA servers (TCP/4840) behind identity-based microsegmentation policies, ensuring only authorized workloads and clients can reach Eclipse Milo endpoints and preventing unauthenticated enumeration via CVE-2026-63248 and padding oracle exploitation via CVE-2026-60007.
- • Deploy Inline IPS (Suricata) with signatures targeting OPC UA protocol anomalies — including repeated malformed chunk submissions, deeply nested ExtensionObject payloads, and abnormal ActivateSession request volumes — to detect and block CVE-2026-63252 and CVE-2026-61387 resource exhaustion attempts before server availability is impacted.
- • Enforce Egress Security and Policy Enforcement controls with FQDN filtering and outbound traffic inspection to detect and block unauthorized data exfiltration of OPC UA session metadata, process data, and harvested credentials leaving ICS network segments to external destinations.
- • Enable Multicloud Visibility and Control with centralized traffic observability and anomaly baselining across all OPC UA server communications to identify anomalous patterns such as repeated unauthenticated ActivateSession requests, unusual batch Call service invocations, and diagnostic node access attempts that indicate active exploitation of authorization bypass CVEs.
- • Implement High Performance Encryption (HPE) for all OPC UA traffic in transit using IPsec or VPN overlays on ICS network segments to eliminate the network on-path attacker precondition required for CVE-2026-60007 padding oracle credential recovery, and prioritize immediate upgrade to Eclipse Milo 1.1.5 as the authoritative vendor remediation for all six CVEs.
