ICS Security Advisories Read for the plant floor, not the patch queue.
CISA ICSA bulletins, analysed for operators
CISA publishes ICS advisories most weeks, and almost none of them arrive with a fix you can deploy this quarter. This is the archive of the ones we have taken apart, plus what contains a flaw you cannot patch.
Last updated:
An ICS advisory is CISA's public notice that a vulnerability has been found in industrial equipment: a PLC, an HMI, a SCADA server, an engineering tool. It carries an ICSA identifier, the affected products and versions, a CVSS score, and the vendor's recommended action. The gap between that document and a safer plant is the part nobody writes down. Industrial equipment is patched on maintenance windows measured in quarters, sometimes years, and some of it will never receive a fix at all. So the operational question is almost never when do we patch. It is what stops someone reaching this device in the meantime.
Advisories we have analysed
Each entry takes one CISA bulletin and answers the same three questions: what the flaw actually allows, whether it is reachable in a normal plant network, and what contains it when the vendor fix is not available to you yet.
- Sep 10, 2026ICSA-26-253-01A Key You Cannot Rotate: AVEVA Pipeline Integrity Monitor (ICSA-26-253-01)CISA's ICSA-26-253-01 covers four flaws in AVEVA Pipeline Integrity Monitor, including a hard-coded cryptographic key. The two 8.4s are local-only, so the whole question is who can already reach the host.Read the analysis
- Sep 3, 2026CVE-2026-75925IXON VPN Client RCE: When the Remote Access Client Is the Attack SurfaceOn September 3, 2026, CISA published ten ICS advisories. One of them, ICSA-26-246-02, covers a CVSS 9.6 vulnerability in the IXON VPN Client that lets an attacker execute commands as root or SYSTEM on the engineer's own machine. IXON found it, fixed it, and blocked unpatched clients from its cloud. The architectural question it raises outlives the patch.Read the analysis
- Aug 27, 2026ICSA-26-239-04The ASE2000 Test Set: When IEC 60870-5-104 TLS Does Not Check the CertificateCISA published ICSA-26-239-04 on August 27, 2026 for the Applied Systems Engineering ASE2000 V2 Communications Test Set. One flaw is an old log4net bug that came in with a bundled library. The other is an IEC 60870-5-104 TLS client that does not properly check certificate errors, which means the encrypted channel you turned on for compliance can be terminated by someone else. CISA lists the affected sectors as Chemical, Critical Manufacturing, Energy, and Water and Wastewater.Read the analysis
- Aug 27, 2026Serial-to-IP Device Servers: Four CISA Advisories in Three DaysBetween August 25 and August 27, 2026, CISA published four advisories against the same narrow device class: Update A to ICSA-26-069-02 for the Lantronix EDS lines, ICSA-26-237-06 for the Ebyte NE2-D11, then ICSA-26-239-05 for the Ebyte NA111-M and ICSA-26-239-01 for the Xiiaozet LK100W. One device class, three days, and a component that almost never appears in an OT asset inventory as a networked device.Read the analysis
- Aug 20, 2026ICSA-26-232-01Credentials Sitting in Memory: Johnson Controls Simplex Incident Manager (ICSA-26-232-01)CISA published ICSA-26-232-01 on August 20, 2026: Johnson Controls Simplex Incident Manager keeps passwords and authentication tokens in cleartext in system memory. It scores 5.8 and is not remotely exploitable, which is exactly why it is worth reading carefully. Credential harvesting is never step one of an intrusion, it is step two.Read the analysis
- Aug 13, 2026ICSA-26-225-01The SCADA You Cannot Patch on Tuesday: AVEVA Enterprise SCADA (ICSA-26-225-01)CISA's ICSA-26-225-01 flags a CVSS 7.1 deserialization-to-code-execution flaw in AVEVA Enterprise SCADA and its HMI. The attacker still needs to reach the service to send the payload. That reach is the part you control.Read the analysis
- Aug 13, 2026ICSA-26-225-02A CVSS 10 on the Box That Faces the Internet: Haiwell IoT Cloud HMI Gateway (ICSA-26-225-02)CISA's ICSA-26-225-02 flags a CVSS 10 OS command injection in the Haiwell IoT Cloud HMI Gateway that runs commands as root. The gateway's whole job is to be reachable. That is exactly the problem, and the fix is to control the reach.Read the analysis
- Aug 13, 2026ICSA-26-225-06The Firewall in the OT Rack Is Also Just Software: Siemens RUGGEDCOM APE1808 (ICSA-26-225-06)CISA's ICSA-26-225-06 carries FortiOS flaws onto the Siemens RUGGEDCOM APE1808, the ruggedized box that runs a firewall inside the plant. The security appliance has its own CVEs. That is the argument for defense in depth, not against firewalls.Read the analysis
- Aug 12, 2026ICSA-26-204-01The Access-Control System That Needs Access Control: Johnson Controls C-CURE 9000 (ICSA-26-204-01)CISA's ICSA-26-204-01 flags a CVSS 9.6 remote-code-execution path in Johnson Controls C-CURE 9000 and victor, the servers that run building access control and video. An attacker with network access is the whole precondition. That is the part you control.Read the analysis
- Aug 7, 2026ICSA-26-218-01ABB Ability Zenon's Bundled MongoDB Flaws: What ICSA-26-218-01 Teaches OT TeamsCISA's ICSA-26-218-01 lists 13 MongoDB CVEs inside ABB Ability Zenon's IIoT services, several reachable without credentials. None of them are in the SCADA logic. They sit in a component you don't get to patch on your own schedule, which changes how you should respond.Read the analysis
What an ICSA number tells you before you open it
The identifier is structured, so a feed of them can be triaged without reading every bulletin end to end.
| Part | What it is | Why it matters |
|---|---|---|
| ICSA | The advisory class | ICSA is a standard industrial control systems advisory. ICSMA covers medical devices. An ICS-ALERT is faster and less complete, used when something is being exploited right now. |
| 26 | The year | Two digits. ICSA-26-225-01 was published in 2026. |
| 225 | The day of the year | Day 225 is mid-August. This is why advisory numbers arrive in clusters: CISA publishes in batches, most often on Tuesdays and Thursdays. |
| 01 | The sequence that day | ICSA-26-225-01 and ICSA-26-225-06 came out together. A high sequence number means a busy release day, not a more serious flaw. |
Severity lives in the CVSS score inside the bulletin, never in the identifier. A CVSS 9.8 and a CVSS 4.3 look identical from the outside.
Five questions that decide whether an advisory is urgent for you
Most advisories that land in an operator's inbox are not urgent and a few are. These separate them faster than the CVSS score does.
01Do you actually run the affected version?
Vendors list affected firmware precisely, and operators rarely hold an inventory precise enough to answer. If checking takes longer than a day, that inventory gap is the real finding, not the advisory.
02Is the device reachable from anywhere a person could stand?
A flaw in an HMI that only answers inside an isolated cell is a different problem from the same flaw on an HMI a vendor dials into. Reachability, not severity, is what makes a bulletin urgent.
03Does exploitation need credentials, and who holds them?
Many ICS advisories require an authenticated session. That turns the question into who has accounts on this device, which is usually a longer list than anyone expects and often includes a shared integrator login.
04Is there a fix you can actually deploy?
A patch that requires a controller restart in a continuous process is not available to you this quarter. Treat it as absent and plan the compensating control instead of waiting.
05If it were exploited, would you know?
For most OT estates the honest answer is no. That answer, rather than the advisory itself, is what should drive the next budget conversation.
Containing a flaw in a device you cannot patch
When the fix is months away or never coming, the remaining move is to change who can reach the device and what they are allowed to do once they get there. Enforcement in front of an asset does not require touching the asset.
- Put an identity check in front of the device, so reaching it needs an authenticated, MFA-backed session even though the device itself supports neither.
- Constrain the protocol rather than the port. Most of these advisories are exploited through a legitimate protocol doing something a normal operator never does, which is visible at the application layer and invisible at the firewall.
- Scope every remote session to one asset, one task, one time window, so a compromised vendor laptop reaches one machine instead of a subnet.
- Record the sessions. If the flaw is exploited through an authorised path, a replay is the only evidence that will exist afterwards.
- Segment down to the asset rather than the level, so the blast radius of an unpatched controller stops at that controller.
Advisory questions
Advisories analysed here in depth, out of the several hundred CISA publishes each year.
It is a public bulletin from the US Cybersecurity and Infrastructure Security Agency describing a vulnerability in industrial control equipment. It names the vendor and the affected versions, gives a CVSS score, describes the attack scenario, lists the affected critical infrastructure sectors, and states the vendor's recommended mitigations. Advisories carry an ICSA identifier, for example ICSA-26-225-01, and are published in batches most weeks.
Most weeks, usually in batches on Tuesdays and Thursdays, running to several hundred a year. The batching is why advisory numbers arrive in clusters: ICSA-26-225-01 through ICSA-26-225-06 were all published on the same day. A busy release day says nothing about how serious any individual bulletin is.
No, and they nest. A CVE is the identifier for one specific vulnerability, assigned centrally. An ICS advisory is CISA's operator-facing write-up, and it usually covers several CVEs in one product at once, adds the industrial context a raw CVE record lacks, and names the sectors affected. One ICSA number commonly carries three or four CVEs.
Assume that is the normal case rather than the exception, and change the reachability of the device instead of its firmware. Put an authenticated, protocol-aware checkpoint in front of it so reaching the flaw requires an identity you control, restrict which protocol commands are allowed through, time-box and record every remote session, and segment so an unpatched controller cannot become a route to anything else. None of that depends on the vendor shipping anything.
Not on its own. CVSS scores the flaw, not your plant. A CVSS 9.8 on a device behind an authenticated proxy, with no route from anywhere a person could stand, is a lower operational risk than a CVSS 6.5 on an HMI a vendor dials into with a shared credential. Reachability and who holds the credentials decide urgency; the score only sets the ceiling.