Indexed vulnerabilities with severity, CVSS, and vendor context.
Upgrade ZoneMinder to version 1.38.3 or later immediately. Download the installer from https://zoneminder.com/downloads or obtain the source code from https://github.com/ZoneMinder/zoneminder. Apply the fix from security advisory GHSA-88m4-hrgp-m9v3. Restrict user permissions to limit the number of authenticated users with View Events access. Monitor for suspicious activity in web server logs.
Cisco security advisories have been released for the five CVEs. Affected users should identify their NX-OS version and apply the relevant patches or software updates as specified in the advisories. It is recommended to monitor Cisco's security portal for updates and follow best practices for network device hardening, including restricting management access and applying the principle of least privilege.
Update Super Forms and Elementor Pro to the latest patched versions immediately. Apply all WordPress security updates. Monitor logs for suspicious file uploads or admin account creation. Implement web application firewall rules to block unauthorized file uploads.
No known patches or mitigations are currently available for CVE-2025-71409 through CVE-2025-71413. CISA advises organizations to follow established internal procedures for suspected malicious activity and to report findings to CISA for tracking. No known public exploitation has been reported. The vulnerabilities are considered exploitable in lab environments with specific conditions and high attack complexity.
CISA encourages rapid remediation and prioritization of security updates. Federal Civilian Executive Branch agencies must follow Binding Operational Directive 26-04, which requires prioritizing patches for KEV Catalog vulnerabilities on publicly exposed assets and checking for pre-existing compromise before applying patches. Organizations should consult vendor-specific advisories for mitigation guidance for each CVE and adopt risk-based vulnerability management practices.
Apply the latest WordPress security updates immediately. Implement web application firewall rules to block suspicious file uploads and path traversal patterns. Monitor server logs for unauthorized file creation or execution. Restrict file permissions and disable unused PHP functions.
Update the miniOrange SAML 2.0 Single Sign On plugin to the latest patched version immediately. If updating is not immediately possible, disable the plugin to prevent exploitation, noting that this may disrupt SAML-based single sign-on functionality.
Configure ABBPCMSchedulerService to run under the same Windows account used for PCM600 operation. Ensure the account has the "Log on as a service" privilege. Use the Scheduler tool with the configured account when IED authentication is enabled. Enable "Always trust IED security certificates" only in secure and trusted environments. Refer to ABB security advisories 2NGA003170 and 2NGA003179.
Rockwell Automation recommends upgrading to software version V5.03. For organizations unable to upgrade immediately, follow security best practices: minimize network exposure for control system devices, ensure systems are not internet-facing, locate control system networks behind firewalls and isolate them from business networks, and use secure remote access methods such as VPNs when required. No known public exploitation has been reported to CISA at the time of the advisory.
Update to firmware version 2.4.5 released by Tycon Systems. Set an administrator username and strong password on the Network Configuration page. Avoid exposing the web interface to the Internet; keep the unit on a private network behind a firewall or VPN. Change any factory-default SNMP community strings and Telnet passwords if left at shipped values. Leave Telnet disabled unless required.
Apply v4.1.0 or later patches for all Airwalls. Additional mitigations: store cryptographic keys in a secure KMS/HSM, implement key rotation, use unique keys per device, remove hardcoded keys from source code, apply least privilege, use static analysis and secrets scanning, encrypt keys at rest and in transit, audit key access, and follow the JCI hardening guide.
Cisco security advisories have been released for the five CVEs. Affected users should identify their NX-OS version and apply the relevant patches or software updates as specified in the advisories. It is recommended to monitor Cisco's security portal for updates and follow best practices for network device hardening, including restricting management access and applying the principle of least privilege.
Cisco security advisories have been released for the five CVEs. Affected users should identify their NX-OS version and apply the relevant patches or software updates as specified in the advisories. It is recommended to monitor Cisco's security portal for updates and follow best practices for network device hardening, including restricting management access and applying the principle of least privilege.
Upgrade to EasyIO Neo Series EC Controllers V3.3b64 or later and CW Controllers V3.3b26 or later. If immediate update is not possible, enforce HTTPS/TLS for all web-based management access, disable HTTP access entirely, place devices on isolated and segmented networks behind a firewall, use a VPN for remote access, and monitor network traffic for unencrypted sensitive data. Apply the recommendations in the Johnson Controls Hardening Guide and refer to advisory JCI-PSA-2026-30 for further guidance.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Update to TPDIN-Monitor-WEB3 Firmware v2.4.2. Units on v2.2.9 should apply the Intel HEX update: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex. Units already on v2.4.2 may use the signed container: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw. Contact Tycon Systems for additional support.
Update Siemens License Server (SLS) to V5.1 or later for CVE-2026-69108 and V5.3 or later for CVE-2026-69109. Minimize network exposure, segment control system networks, and use VPNs for remote access. Follow Siemens operational guidelines for industrial security.
Organizations should prioritize patching CVE-2025-39682 by applying vendor-provided security updates as soon as they are available. Under BOD 26-04, FCEB agencies must remediate the vulnerability rapidly and check for signs of compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management and monitor CISA advisories for updates.
Organizations should apply the AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update and migrate affected project files. For files that cannot be migrated, evaluate the risk of password leakage and implement stricter read access controls. Require PIMBoards users to change their passwords after migration. Migration is one-way due to changes in password hashing algorithms and encryption keys.
Wärtsilä has developed a security patch for the affected version. Users are directed to contact Wärtsilä to obtain and install the latest patch via https://www.wartsila.com/services-catalogue/engine-services-4-stroke/wartsila-ics-patch-deployment#contact. CISA recommends minimizing network exposure for control system devices, ensuring they are not internet-accessible, locating control system networks behind firewalls and isolating them from business networks, and using secure remote access methods such as VPNs when remote access is required. Organizations should perform impact analysis and risk assessment prior to deploying defensive measures.
Until a patch is released, organizations using Kaltura's mwEmbed library should monitor for updates from Kaltura, restrict network access to the mwEmbedLoader.php endpoint where possible, and implement input validation and monitoring for deserialization-related anomalies.
Organizations should prioritize rapid remediation of the listed KEV Catalog vulnerabilities, particularly on publicly exposed assets. Federal Civilian Executive Branch agencies must follow BOD 26-04 requirements, which include prioritizing patches for vulnerabilities granting total control post-exploitation and checking for prior compromise before applying updates. All organizations are encouraged to adopt risk-based vulnerability management practices, apply vendor-released security updates, and monitor for exploitation activity. Specific mitigation guidance should be obtained from the respective vendors (Red Hat, Microsoft, Citrix, etc.) for each CVE.
Configure ABBPCMSchedulerService to run under the same Windows account used for PCM600 operation. Ensure the account has the "Log on as a service" privilege. Use the Scheduler tool with the configured account when IED authentication is enabled. Enable "Always trust IED security certificates" only in secure and trusted environments. Refer to ABB security advisories 2NGA003170 and 2NGA003179.
Users and administrators should update Google Chrome and Chromium-based browsers to the latest available version. CISA encourages organizations to apply security updates promptly and adopt risk-based vulnerability management practices. Federal agencies must follow BOD 26-04 requirements for prioritizing KEV Catalog remediation on publicly exposed assets.
CISA recommends minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods such as VPNs, recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Perform proper impact analysis and risk assessment prior to deploying defensive measures. CareCam has not responded to CISA's coordination attempts; users are encouraged to reach out to the vendor directly.
CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks and remote devices behind firewalls isolated from business networks. When remote access is required, use VPNs updated to the most current version. Organizations should perform proper impact analysis and risk assessment prior to deploying defensive measures. Users are advised to contact Meari for support as no official fix is planned.
Organizations should apply vendor-provided patches for CVE-2026-21962 as soon as possible. FCEB agencies must follow BOD 26-04 requirements, including prioritizing remediation on publicly exposed assets and checking for signs of compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management and monitor for indicators of compromise.
Security teams should monitor Microsoft's security updates for CVE-2026-69414. Apply any released patches immediately. Implement network segmentation and application whitelisting to reduce the risk of malware evading Defender detections. Follow Microsoft's guidance on temporary mitigations if available.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Organizations using Check Point VPN should monitor official Check Point advisories and apply security updates as released. Until patches are available, implement network segmentation and review VPN access controls to reduce attack surface.
Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
Upgrade to Unbound 1.26.1 immediately. Until patched, consider restricting recursive queries to trusted clients and monitoring DNS traffic for anomalies. Apply vendor patches as soon as possible.
Upgrade Armatura One to V4.7.2 (global) or V4.6.1_USA (USA line) at the earliest opportunity. Contact Armatura LLC official technical support for guidance on obtaining and applying upgrades. Refer to CISA advisory ICSA-26-274-01 for additional mitigation guidance. Restrict network access to the ActiveMQ OpenWire listener where possible.
As of the disclosure date, no patch information has been provided by Unitree. Organizations using the G1 EDU should monitor Unitree's official channels for firmware updates and security advisories. Until a patch is available, consider restricting network access to the robot and disabling Bluetooth when not in use. Additionally, ensure the robot is deployed in a controlled environment to minimize the risk of unauthorized physical or network access.
Organizations should upgrade to PowerChute Serial Shutdown version 1.6, available for Windows and Linux. After installation, the service restarts automatically; verify the version via the Control Panel or About page. Additionally, follow Schneider Electric's recommended cybersecurity best practices, including network segmentation, physical security controls, and minimizing exposure of control systems to the internet.
Update the Mendix SAML module to V4.2.3 or later (Mendix 10/11 compatible) or V3.6.27 or later (Mendix 9.24 compatible). Minimize network exposure by ensuring affected devices are not internet-facing. Locate control system networks behind firewalls and isolate from business networks. Use updated VPNs for remote access. Perform impact analysis and risk assessment before deploying defensive measures.
Update SIMATIC IoT2050 Advanced to version 4.3.4.1 or later. Harden the Node-RED installation following the Node-RED User Guide, or uninstall Node-RED if not required. Minimize network exposure by isolating control system devices behind firewalls and ensuring they are not internet-accessible. Use VPNs for remote access and keep VPN software updated.
Apply vendor-supplied patches to update affected Siveillance Control products to the minimum patched versions (V3.0.12.2173 or later for Pro V3.0, V4.0.9.2178 or later for Pro V4.0, V3.0.22.2177 or later for V3.0, V4.0.11.2177 or later for V4.0). Minimize network exposure by isolating OIS web module devices behind firewalls and ensuring they are not accessible from the internet. When remote access is required, use VPNs updated to the most recent version. Follow Siemens ProductCERT advisory SSA-254516 for additional guidance.
Apply the latest cPanel & WHM updates immediately. cPanel has released patches for all supported versions. Review system logs for any unauthorized activity following update deployment.
Update Forminator Forms to the latest patched version when available. Implement file upload restrictions and validation. Use web application firewall rules to block suspicious file uploads. Monitor official Forminator security advisories for patch release. Apply WordPress security best practices including regular updates and restricted file permissions.
Update affected devices to the latest firmware versions: Desigo DXR2 and PXC3 to V01.21.233.16-7862 or later; Desigo PXC4, PXC5.E003, PXC5.E24, and PXC7 to V02.21.194.36-2715 or later. Additionally, restrict network access to BACnet devices, isolate control networks from business networks, and use firewalls or VPNs for remote access.
Organizations should prioritize rapid remediation of the listed KEV Catalog vulnerabilities, particularly on publicly exposed assets. Federal Civilian Executive Branch agencies must follow BOD 26-04 requirements, which include prioritizing patches for vulnerabilities granting total control post-exploitation and checking for prior compromise before applying updates. All organizations are encouraged to adopt risk-based vulnerability management practices, apply vendor-released security updates, and monitor for exploitation activity. Specific mitigation guidance should be obtained from the respective vendors (Red Hat, Microsoft, Citrix, etc.) for each CVE.
D-Link recommends replacing the DIR-822A routers with supported hardware due to the lack of a patch. Users should disconnect legacy devices from the network if replacement is not immediately possible. Monitor D-Link advisories for any future security updates.
Upgrade to NetStaX v5.6.1 or later. For systems where immediate upgrade is not possible, CISA recommends: minimizing network exposure for control system devices, ensuring devices are not internet-accessible, locating control system networks behind firewalls and isolating them from business networks, and using VPNs updated to the most current version when remote access is required. Perform proper impact analysis and risk assessment prior to deploying defensive measures.
Update PostgreSQL to the patched versions: 18.6, 17.11, 16.15, 15.19, or 14.24 or later. Apply the released security updates immediately. Review and restrict REPLICATION attribute assignments to trusted accounts only. Disable logical decoding if not required for your deployment.
CISA and Cisco encourage affected organizations to apply vendor patches for Cisco Secure Email Gateway as soon as possible. Federal agencies must follow the remediation timelines and requirements specified in Binding Operational Directive (BOD) 26-04. Organizations should also check whether threat actors may have already compromised systems before applying patches, and document any pre-compromise indicators. All organizations are advised to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Organizations should apply vendor-provided patches immediately. For Cisco ASA/FTD, consult Cisco security advisories. For Microsoft Windows, apply the latest security updates. For Metabase, follow the vendor's guidance. Additionally, review systems for indicators of compromise before patching, as recommended by BOD 26-04.
Users should upgrade to Haiwell IoT Cloud HMI Gateway patch version Scada-v3.50.1.19 or later. CISA recommends minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is required, use more secure methods such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. Organizations should perform proper impact analysis and risk assessment prior to deploying defensive measures.
Users should immediately update all affected WordPress plugins and themes to their latest available versions. Enable web application firewall rules to block known exploitation patterns. Monitor Wordfence and Patchstack advisories for vendor-specific patches and detailed mitigation guidance. Apply the principle of least privilege to user accounts and regularly audit plugin and theme permissions.