ICS security advisories, decoded for the plant floor.
CISA publishes ICS advisories most weeks. Almost none arrive with a fix you can deploy this quarter. This archive covers the ones we have taken apart, and how to contain a flaw you cannot patch.
Last updated:
An ICS advisory is CISA's public notice that a vulnerability has been found in industrial equipment: a PLC, an HMI, a SCADA server, an engineering tool.
Each advisory carries:
- an ICSA identifier
- the affected products and versions
- a CVSS score
- the vendor's recommended action
Nobody writes down the gap between that document and a safer plant. Industrial equipment is patched on maintenance windows measured in quarters, sometimes years, and some of it will never receive a fix at all.
So the operational question is what stops someone reaching this device in the meantime.
Advisories we have analysed.
Each entry takes one CISA bulletin and answers the same three questions. What does the flaw actually allow? Is it reachable in a normal plant network? And what contains it while the vendor fix is not available to you?
- Oct 9, 2026ICSA-26-281-02openPDC and openHistorian Flaws: Patch, Then Gate the Historian (ICSA-26-281-02)CISA's ICSA-26-281-02 covers six CVEs in Grid Protection Alliance openPDC and openHistorian, the open-source phasor data concentrator and historian used by utilities. The worst, CVSS 9.8, lets an unauthenticated attacker run code through the service console. Patches exist, but upgraded installs keep their old network bindings and the Docker image gets no fix, so the second job is to control who can reach the server.Grid Protection AlliancePower GridNERC CIPEnergyRead the analysis
- Oct 9, 2026ICSA-26-281-01Red Lion N-Tron 700 Switches: Patch, Then Lock the Admin Interface (ICSA-26-281-01)CISA's ICSA-26-281-01 covers seven CVEs in Red Lion N-Tron 700 Series managed industrial Ethernet switches, firmware 3.11.0 and earlier. A default admin account that persists, passwords stored in plaintext, and SNMP admin actions with no login add up to full control of the switch. The fix is firmware 3.11.1, then limit who can reach the switch's web interface, SSH and SNMP.Red LionNetwork SecurityManufacturingRemote AccessRead the analysis
- Oct 9, 2026Serial-to-IP Device Servers: Four CISA Advisories in Three DaysBetween August 25 and August 27, 2026, CISA published four advisories against the same narrow device class: Update A to ICSA-26-069-02 for the Lantronix EDS lines, ICSA-26-237-06 for the Ebyte NE2-D11, then ICSA-26-239-05 for the Ebyte NA111-M and ICSA-26-239-01 for the Xiiaozet LK100W. One device class, three days, and a component that almost never appears in an OT asset inventory as a networked device.Serial to EthernetAsset InventoryCritical InfrastructureRead the analysis
- Oct 1, 2026ICSA-26-258-04Protect a SCADAPack x70 RTU With No Patch (ICSA-26-258-04)CISA's ICSA-26-258-04 covers CVE-2026-81861 in Schneider Electric SCADAPack x70 RTUs: the legacy Secure Lock feature protects passwords with keys built into every device, so anyone who captures an unlock or password change can recover the password. All versions are affected and there is no firmware fix. The fix is configuration, and here is the order to do it in.Schneider ElectricSCADAWaterRemote AccessRead the analysis
- Oct 1, 2026ICSA-26-258-05Siemens Reyrolle 7SR5 Relays: What to Do Before You PatchCISA's ICSA-26-258-05 covers 14 CVEs in Siemens Reyrolle 7SR5 protection relays before V2.70. The most severe, CVSS 9.8, lets an attacker calculate web session IDs and skip the login. Relay firmware takes time to test and roll out, so the first job is to control who can reach the relay's web interface.SiemensPower GridNERC CIPOT Remote AccessEnergyRead the analysis
- Sep 24, 2026ICSA-26-225-01The SCADA You Cannot Patch on Tuesday: AVEVA Enterprise SCADA (ICSA-26-225-01)CISA's ICSA-26-225-01 flags a CVSS 7.1 deserialization-to-code-execution flaw in AVEVA Enterprise SCADA and its HMI. The attacker still needs to reach the service to send the payload. That reach is the part you control.AVEVASCADARemote AccessRead the analysis
- Sep 24, 2026ICSA-26-253-01A Key You Cannot Rotate: AVEVA Pipeline Integrity Monitor (ICSA-26-253-01)CISA's ICSA-26-253-01 covers four flaws in AVEVA Pipeline Integrity Monitor, including a hard-coded cryptographic key. The two 8.4s are local-only, so the whole question is who can already reach the host.AVEVASCADACritical ManufacturingRemote AccessRead the analysis
- Sep 24, 2026What to Do About the lwIP Vulnerabilities in ICSA-26-265-01 and -02On September 22, 2026, CISA published two advisories for lwIP, the open-source TCP/IP stack compiled into a large share of embedded devices. One flaw in the MQTT client scores 9.8 and can lead to code execution. The fix is a commit in a source repository, so your devices stay vulnerable until each device maker ships new firmware. Until then, limit which systems can talk to those devices.Vulnerability ManagementSupply ChainSegmentationRead the analysis
- Sep 24, 2026ICSA-26-265-06Siemens Industrial Edge Management Password Reset Flaw (ICSA-26-265-06)CISA's ICSA-26-265-06 covers CVE-2026-18963 in Siemens Industrial Edge Management, the console that deploys apps to every Industrial Edge device on a site. A flaw in the Keycloak reset-credentials flow lets an unauthenticated attacker set a new password for any account. Each of Siemens' three workarounds limits who can use the login page.SiemensOT Remote AccessIdentityCritical ManufacturingRead the analysis
- Sep 17, 2026ICSA-26-260-03A 9.9 in the Grid's Power-Flow Controllers: Hitachi Energy FACTS (ICSA-26-260-03)CISA's ICSA-26-260-03 lists five CVEs in the GWS component of Hitachi Energy's FACTS Control Platform, the controllers behind STATCOMs, SVCs and series capacitors. Two score 9.9. The remediation is a list of mitigations. What that means for a transmission operator.Hitachi EnergySCADARemote AccessSegmentationRead the analysis
- Sep 17, 2026ICSA-26-260-04One FTP Packet Stops the PLC: Schneider Modicon M340 (ICSA-26-260-04)CISA's ICSA-26-260-04 covers CVE-2025-6625 in the Modicon M340 controller and its Ethernet modules: a crafted FTP command causes a denial of service, no login needed. Two of the modules have no fix yet. What a water plant should do this week.Schneider ElectricSCADASegmentationRemote AccessRead the analysis
- Sep 3, 2026CVE-2026-75925IXON VPN Client RCE: When the Remote Access Client Is the Attack SurfaceOn September 3, 2026, CISA published ten ICS advisories. One of them, ICSA-26-246-02, covers a CVSS 9.6 vulnerability in the IXON VPN Client that lets an attacker execute commands as root or SYSTEM on the engineer's own machine. IXON found it, fixed it, and blocked unpatched clients from its cloud. The architectural question it raises outlives the patch.OT Remote AccessZero TrustVulnerability ManagementCritical InfrastructureRead the analysis
- Aug 27, 2026ICSA-26-239-04The ASE2000 Test Set: When IEC 60870-5-104 TLS Does Not Check the CertificateCISA published ICSA-26-239-04 on August 27, 2026 for the Applied Systems Engineering ASE2000 V2 Communications Test Set. One flaw is an old log4net bug that came in with a bundled library. The other is an IEC 60870-5-104 TLS client that does not properly check certificate errors, which means the encrypted channel you turned on for compliance can be terminated by someone else. CISA lists the affected sectors as Chemical, Critical Manufacturing, Energy, and Water and Wastewater.ASENERC CIPWater and WastewaterEngineering WorkstationsRead the analysis
- Aug 20, 2026ICSA-26-232-01Credentials Sitting in Memory: Johnson Controls Simplex Incident Manager (ICSA-26-232-01)CISA published ICSA-26-232-01 on August 20, 2026: Johnson Controls Simplex Incident Manager keeps passwords and authentication tokens in cleartext in system memory. It scores 5.8 and is not remotely exploitable, which is exactly why it is worth reading carefully. Credential harvesting is never step one of an intrusion, it is step two.Johnson ControlsBuilding AutomationIdentityCredentialsRead the analysis
- Aug 13, 2026ICSA-26-225-02A CVSS 10 on the Box That Faces the Internet: Haiwell IoT Cloud HMI Gateway (ICSA-26-225-02)CISA's ICSA-26-225-02 flags a CVSS 10 OS command injection in the Haiwell IoT Cloud HMI Gateway that runs commands as root. The gateway's whole job is to be reachable. That is exactly the problem, and the fix is to control the reach.HaiwellRemote AccessHMIRead the analysis
- Aug 13, 2026ICSA-26-225-06The Firewall in the OT Rack Is Also Just Software: Siemens RUGGEDCOM APE1808 (ICSA-26-225-06)CISA's ICSA-26-225-06 carries FortiOS flaws onto the Siemens RUGGEDCOM APE1808, the ruggedized box that runs a firewall inside the plant. The security appliance has its own CVEs. That is the argument for defense in depth, not against firewalls.SiemensSegmentationRemote AccessRead the analysis
- Aug 12, 2026ICSA-26-204-01The Access-Control System That Needs Access Control: Johnson Controls C-CURE 9000 (ICSA-26-204-01)CISA's ICSA-26-204-01 flags a CVSS 9.6 remote-code-execution path in Johnson Controls C-CURE 9000 and victor, the servers that run building access control and video. An attacker with network access is the whole precondition. That is the part you control.Johnson ControlsBuilding AutomationPhysical SecurityRemote AccessRead the analysis
- Aug 7, 2026ICSA-26-218-01ABB Ability Zenon's Bundled MongoDB Flaws: What ICSA-26-218-01 Teaches OT TeamsCISA's ICSA-26-218-01 lists 13 MongoDB CVEs inside ABB Ability Zenon's IIoT services, several reachable without credentials. None of them are in the SCADA logic. They sit in a component you don't get to patch on your own schedule, which changes how you should respond.ABBSCADASupply ChainIndustrial ProxyRead the analysis
What an ICSA number tells you.
The identifier is structured, so a feed of them can be triaged without reading every bulletin end to end.
| Part | What it is | Why it matters |
|---|---|---|
| ICSA | The advisory class | ICSA is a standard industrial control systems advisory. ICSMA covers medical devices. An ICS-ALERT is faster and less complete, used when something is being exploited right now. |
| 26 | The year | Two digits. ICSA-26-225-01 was published in 2026. |
| 225 | The day of the year | Day 225 is mid-August. This is why advisory numbers arrive in clusters: CISA publishes in batches, most often on Tuesdays and Thursdays. |
| 01 | The sequence that day | ICSA-26-225-01 and ICSA-26-225-06 came out together. A high sequence number means a busy release day, not a more serious flaw. |
Severity lives in the CVSS score inside the bulletin, never in the identifier. A CVSS 9.8 and a CVSS 4.3 look identical from the outside.
Five questions that decide urgency.
Most advisories that land in an operator's inbox are not urgent, and a few are. These five questions separate them faster than the CVSS score does.
01Do you actually run the affected version?
Vendors list affected firmware precisely, and operators rarely hold an inventory precise enough to answer. If checking takes longer than a day, that inventory gap is the real finding, not the advisory.
02Is the device reachable from anywhere a person could stand?
A flaw in an HMI that only answers inside an isolated cell is a different problem from the same flaw on an HMI a vendor dials into. Reachability, not severity, is what makes a bulletin urgent.
03Does exploitation need credentials, and who holds them?
Many ICS advisories require an authenticated session. That turns the question into who has accounts on this device, which is usually a longer list than anyone expects and often includes a shared integrator login.
04Is there a fix you can actually deploy?
A patch that requires a controller restart in a continuous process is not available to you this quarter. Treat it as absent and plan the compensating control instead of waiting.
05If it were exploited, would you know?
For most OT estates the honest answer is no. That answer, rather than the advisory itself, is what should drive the next budget conversation.
Contain a flaw you cannot patch.
When the fix is months away or never coming, one move remains. Change who can reach the device, and what they are allowed to do once they get there. Enforcement in front of an asset does not require touching the asset.
- Put an identity check in front of the device, so reaching it needs an authenticated, MFA-backed session even though the device itself supports neither.
- Constrain the protocol rather than the port. Most of these advisories are exploited through a legitimate protocol doing something a normal operator never does, which is visible at the application layer and invisible at the firewall.
- Scope every remote session to one asset, one task, one time window, so a compromised vendor laptop reaches one machine instead of a subnet.
- Record the sessions. If the flaw is exploited through an authorised path, a replay is the only evidence that will exist afterwards.
- Segment down to the asset rather than the level, so the blast radius of an unpatched controller stops at that controller.
Common questions about ICS advisories.
Advisories analysed here in depth, out of the several hundred CISA publishes each year.
It is a public bulletin from the US Cybersecurity and Infrastructure Security Agency describing a vulnerability in industrial control equipment. It names the vendor and the affected versions, gives a CVSS score, describes the attack scenario, lists the affected critical infrastructure sectors, and states the vendor's recommended mitigations. Advisories carry an ICSA identifier, for example ICSA-26-225-01, and are published in batches most weeks.
Most weeks, usually in batches on Tuesdays and Thursdays, running to several hundred a year. The batching is why advisory numbers arrive in clusters: ICSA-26-225-01 through ICSA-26-225-06 were all published on the same day. A busy release day says nothing about how serious any individual bulletin is.
No, and they nest. A CVE is the identifier for one specific vulnerability, assigned centrally. An ICS advisory is CISA's operator-facing write-up. It usually covers several CVEs in one product at once, adds the industrial context a raw CVE record lacks, and names the sectors affected. One ICSA number commonly carries three or four CVEs.
Assume that is the normal case, and change the reachability of the device instead of its firmware. Put an authenticated, protocol-aware checkpoint in front of it, so reaching the flaw requires an identity you control. Restrict which protocol commands are allowed through. Time-box and record every remote session. Segment, so an unpatched controller cannot become a route to anything else. None of that depends on the vendor shipping anything.
Not on its own. CVSS scores the flaw. It does not score your plant. Take a CVSS 9.8 on a device behind an authenticated proxy, with no route from anywhere a person could stand. Its operational risk is lower than a CVSS 6.5 on an HMI a vendor dials into with a shared credential. Reachability and who holds the credentials decide urgency; the score only sets the ceiling.