Indexed vulnerabilities with severity, CVSS, and vendor context.
Update Siemens Simcenter Nastran and Simcenter Femap to V2606 or later versions. Protect network access to devices with appropriate mechanisms. Follow Siemens' operational guidelines for Industrial Security. Minimize network exposure and ensure control system devices are not accessible from the internet. Use firewalls and isolate control system networks from business networks.
Apply the patches released by Red Hat and the Keycloak project immediately. Administrators should update their Keycloak installations to the latest patched versions to prevent exploitation. Review access controls and monitor for unusual password reset activity.
Update Siemens LOGO! Soft Comfort to version V9 or later. Additionally, upgrade hardware to LOGO! V9 BM or later to avoid compatibility mode where vulnerabilities remain present. Restrict local access to LOGO! Soft Comfort workstations and enforce physical security measures.
Organizations should prioritize rapid remediation of the listed KEV Catalog vulnerabilities, particularly on publicly exposed assets. Federal Civilian Executive Branch agencies must follow BOD 26-04 requirements, which include prioritizing patches for vulnerabilities granting total control post-exploitation and checking for prior compromise before applying updates. All organizations are encouraged to adopt risk-based vulnerability management practices, apply vendor-released security updates, and monitor for exploitation activity. Specific mitigation guidance should be obtained from the respective vendors (Red Hat, Microsoft, Citrix, etc.) for each CVE.
No known patches or mitigations are currently available for CVE-2025-71409 through CVE-2025-71413. CISA advises organizations to follow established internal procedures for suspected malicious activity and to report findings to CISA for tracking. No known public exploitation has been reported. The vulnerabilities are considered exploitable in lab environments with specific conditions and high attack complexity.
Install the latest firmware updates provided by Flow Neuroscience via the Flow app. Minimize network exposure for all control system devices and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use secure methods such as VPNs when remote access is required, and keep VPN software updated. Perform impact analysis and risk assessment prior to deploying defensive measures.
Organizations should apply vendor patches from Microsoft and MikroTik as soon as possible. CISA KEV catalog entries typically require applicable updates to mitigate the vulnerabilities. Prioritize patching internet-facing SharePoint servers and MikroTik routers.
Apply the update provided by Mitsubishi Electric (Update A) to all affected products. Additionally, implement network segmentation to isolate control system networks from untrusted networks, restrict physical and logical access to the network segment, and monitor for anomalous traffic patterns.
Bendix recommends updating firmware to the most recent versions: Z300822 for Z228999 firmware revisions, Z302578 for Z266494 revisions, and Z302579 for Z286098 revisions. Users should contact Bendix at info@Bendix.com for assistance.
Organizations should apply vendor-provided patches immediately. For Cisco ASA/FTD, consult Cisco security advisories. For Microsoft Windows, apply the latest security updates. For Metabase, follow the vendor's guidance. Additionally, review systems for indicators of compromise before patching, as recommended by BOD 26-04.
Organizations using Gitea should apply security updates promptly to mitigate CVE-2026-60004. Per BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check for threat actor compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management practices and monitor CISA and Gitea advisories for patch availability and exploitation updates.
Johnson Controls recommends applying the latest available patches for affected Metasys versions. Metasys 15.0: patch released 2026-03-25. Metasys 14.1.5: forecast release 2026-07-15. Metasys 16.0: not impacted. Metasys 12 and 13: end of support, upgrade to later version. Additional measures: restrict network access to the Metasys UI to trusted networks, implement network segmentation, enforce least-privilege access controls, implement Content Security Policy headers, deploy a web application firewall, and monitor for suspicious URL patterns and script execution in access logs.
Cisco has released security updates addressing CVE-2026-20079. Users of affected Secure Firewall Management Center versions should upgrade to the latest patched releases immediately. Specific patch versions and download links are available in Cisco's security advisory PSA-2026-0282. As a defensive measure, restrict access to the FMC management interface to trusted networks and implement strong network segmentation.
Organizations should upgrade Orthanc DICOM Server to version 1.13.0 or later, as recommended by the vendor. Additionally, CISA advises minimizing network exposure of control systems and medical devices, ensuring they are not accessible from the internet, and placing them behind firewalls isolated from business networks. When remote access is necessary, use secure methods such as VPNs, and keep all systems updated. Perform impact analysis and risk assessment before deploying defensive measures.
Update Siemens Simcenter Femap to version V2606.0001 or later. Apply the vendor fix available at https://support.sw.siemens.com/product/275652363/. Minimize network exposure for Simcenter Femap instances and avoid opening untrusted BMP files with the application. Follow Siemens operational guidelines for industrial security.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Apply the latest Linux kernel patches that address the KVM ARM64 memory handling code. Disable nested virtualization if not required. Monitor vendor advisories and kernel security mailing lists for follow-up updates. Ensure systems are running kernel versions containing the fix for CVE-2026-89775.
Update to the latest patched version of Elementor Pro immediately. Apply all available security updates from the Elementor development team. Monitor official Elementor security advisories for further details and confirmation of patches.
Update affected Siveillance Video Management Server software to the latest hotfix versions: V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, or V25.1 HotfixRev15 or later. Restrict network access to Management Server interfaces. Apply principle of least privilege for user permissions. Follow Siemens and CISA recommended security practices for industrial control system devices.
Users should upgrade Roundcube Webmail to version 1.6.16 or 1.7.1 immediately to apply the fix for CVE-2026-48842. If immediate upgrading is not possible, consider disabling the virtuser_query plugin or implementing network controls to limit exposure. Monitor for patches from Roundcube developers and apply them as soon as possible.
Update Google Chrome to the latest version immediately. Enable automatic updates to receive security fixes promptly.
Implement Role-Based Access Control (RBAC) as recommended by Schneider Electric and follow the Security Guidelines for Administrators. Configure network segmentation to restrict access between trusted and untrusted networks. Enable and implement the RTU firewall service to restrict unauthorized access to device services. Consult the SCADAPack Cybersecurity Guide for hardening and secured communication best practices. Apply all standard practices referenced in the SCADAPack Cybersecurity Guide, including locating control system networks behind firewalls and isolating them from business networks.
Broadcom has released security updates addressing CVE-2026-59346 and a second flaw. Users should update VMware Workstation and Fusion to the latest patched versions immediately. Apply the available patches to eliminate the vulnerability. Monitor VMware security advisories for any additional information regarding the second flaw or future updates.
Update affected products to the minimum patched versions: SIMOVE Fleetmanager V3.1.13 or later, V3.2.4 or later, V3.3.2 or later, or V4.0.1 or later. SIPLANT V3.1.4 or later. Restrict network access to affected devices behind firewalls. Implement user management to limit services' access rights to project files. Isolate control system networks from business networks per Siemens operational guidelines.
Inductive Automation recommends upgrading to Ignition 8.1.54 or later, or the latest 8.3 version, which restricts project creation to Designer sessions and no longer relies on the "Create Project Role(s)" setting. Users on earlier 8.1 versions should populate the "Create Project Role(s)" setting to match their Designer Role, restricting project creation to authorized users only. CISA also recommends minimizing network exposure, placing control system devices behind firewalls, and using VPNs for remote access.
CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
Apply vendor-fixed versions: BC or later for M800VW/M800VS/M80V/M80VW; FN or later for M800W/M800S/M80/M80W/E80; LK or later for M750VW/M730VW/M720VW/M750VS/M730VS/M720VS/M70V/E70. Use firewall or VPN to prevent unauthorized access. Operate products within LAN and block untrusted network access when internet connectivity is required.
Organizations should apply vendor patches for PaperCut NG/MF as soon as available. Federal agencies must prioritize rapid remediation per Binding Operational Directive (BOD) 26-04. All organizations are encouraged to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. Check systems for compromise before applying patches per BOD 26-04 requirements.
SolarWinds has released security updates to address the flaw. Users should update Access Rights Manager to the latest patched version immediately. It is recommended to monitor SolarWinds advisories for additional details and to apply patches within established maintenance windows.
Mitsubishi Electric GX Works3: version 1.096A or later. Mitsubishi Electric Motion Control Settings: version 1.070Y or later. Set security version to "2" in project settings. Restrict physical access to affected computers. Block remote logins from untrusted networks. Use firewalls or VPNs to prevent unauthorized access. Restrict physical and network access to authorized users only.
Organizations should upgrade NetBotz 5 750 and 755 to firmware version 5.6.0, available from Schneider Electric's product page. Additionally, follow vendor recommendations: isolate control networks, use firewalls, restrict physical access, and avoid connecting programming software to untrusted networks.
Apply patches released by Langflow and Ruby on Rails maintainers immediately. Monitor system logs for unusual Python execution or unexpected process behavior. Implement network segmentation and restrict inbound access to Langflow deployments. Update Ruby on Rails applications to the latest secure version. Review and harden credential management practices.
Cisco security advisories have been released for the five CVEs. Affected users should identify their NX-OS version and apply the relevant patches or software updates as specified in the advisories. It is recommended to monitor Cisco's security portal for updates and follow best practices for network device hardening, including restricting management access and applying the principle of least privilege.
Organizations should apply vendor-provided patches immediately. For Cisco ASA/FTD, consult Cisco security advisories. For Microsoft Windows, apply the latest security updates. For Metabase, follow the vendor's guidance. Additionally, review systems for indicators of compromise before patching, as recommended by BOD 26-04.
Rockwell Automation has released Redundancy Module Configuration Tool version 10.01.00 which addresses CVE-2026-9633 and CVE-2026-9634. Users are strongly advised to upgrade to the latest version immediately. Customers unable to upgrade should consult Rockwell Automation's security best practices and mitigation guidance published on the vendor's support portal and security advisories page. CISA recommends applying defensive measures outlined in advisory ICSA-26-244-02.
Apply the latest Adobe security updates for ColdFusion and Campaign Classic immediately. Verify all systems are running the patched versions. Monitor Adobe security advisories for additional details and scope of the addressed vulnerabilities.
Apply the latest GitLab patches immediately. For self-hosted instances, update to the patched version as specified in the GitLab security advisory. For GitLab.com, ensure the instance is up to date with the latest platform updates. Review file access permissions and restrict access to sensitive directories as a defense-in-depth measure.
As of the disclosure date, no patch information has been provided by Unitree. Organizations using the G1 EDU should monitor Unitree's official channels for firmware updates and security advisories. Until a patch is available, consider restricting network access to the robot and disabling Bluetooth when not in use. Additionally, ensure the robot is deployed in a controlled environment to minimize the risk of unauthorized physical or network access.
Organizations should upgrade NetBotz 5 750 and 755 to firmware version 5.6.0, available from Schneider Electric's product page. Additionally, follow vendor recommendations: isolate control networks, use firewalls, restrict physical access, and avoid connecting programming software to untrusted networks.
Organizations using Citrix NetScaler should apply the latest firmware updates as released by Citrix. Monitor official Citrix security advisories for CVE-2026-19490. If immediate patching is not possible, consider temporary network segmentation or access controls to limit exposure of NetScaler management interfaces. Ensure all NetScaler deployments are running the most recent supported software versions.
Update affected firmware to WTV676-HB6035 Web Interface V3.94 or later, or WTV776-HB6035 Web Interface V4.17 or later. Minimize network exposure by ensuring affected devices are not accessible from the internet. Locate control system networks behind firewalls and isolate from business networks. Use VPNs for remote access and keep VPNs and connected devices updated.
CISA recommends minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use VPNs for remote access, updated to the most current version. Perform proper impact analysis and risk assessment prior to deploying defensive measures. Contact PayRange customer support at support@payrange.com for additional information. Note: PayRange has not responded to requests to work with CISA to mitigate this vulnerability.
Rockwell Automation has released Redundancy Module Configuration Tool version 10.01.00 which addresses CVE-2026-9633 and CVE-2026-9634. Users are strongly advised to upgrade to the latest version immediately. Customers unable to upgrade should consult Rockwell Automation's security best practices and mitigation guidance published on the vendor's support portal and security advisories page. CISA recommends applying defensive measures outlined in advisory ICSA-26-244-02.
Apply Microsoft's August 2026 security updates promptly. Prioritize patching of Windows DNS Server components, especially on internet-facing systems. Monitor Microsoft security advisories for additional details and verification of the vulnerability specifics. Implement network segmentation and access controls for DNS server roles as defense-in-depth measures while awaiting patch deployment.
Affected users should update their CISA Malcolm instance to version 26.06.0 or later. The September 2026 release or subsequent versions contain the necessary fixes. No temporary workarounds are documented in the advisory.