Indexed vulnerabilities with severity, CVSS, and vendor context.
Organizations using Check Point VPN should monitor official Check Point advisories and apply security updates as released. Until patches are available, implement network segmentation and review VPN access controls to reduce attack surface.
Inductive Automation recommends upgrading to Ignition 8.1.54 or later, or the latest 8.3 version, which restricts project creation to Designer sessions and no longer relies on the "Create Project Role(s)" setting. Users on earlier 8.1 versions should populate the "Create Project Role(s)" setting to match their Designer Role, restricting project creation to authorized users only. CISA also recommends minimizing network exposure, placing control system devices behind firewalls, and using VPNs for remote access.
Update Forminator Forms to the latest patched version when available. Implement file upload restrictions and validation. Use web application firewall rules to block suspicious file uploads. Monitor official Forminator security advisories for patch release. Apply WordPress security best practices including regular updates and restricted file permissions.
Update Bifrost to version 2.1.0 or later, which addresses the vulnerability by properly enforcing management authentication. For organizations unable to update immediately, implement management authentication configuration, restrict network exposure of the gateway management interface, and monitor for suspicious HTTP requests targeting the Bifrost management endpoint.
Update Siemens Solid Edge to V225.0.15 or later (SE2025) or V226.0.7 or later (SE2026). Apply patches from https://support.sw.siemens.com/product/246738425/. Restrict execution of untrusted PAR, PSM, and DFT files. Apply application whitelisting where possible.
Organizations should upgrade NetBotz 5 750 and 755 to firmware version 5.6.0, available from Schneider Electric's product page. Additionally, follow vendor recommendations: isolate control networks, use firewalls, restrict physical access, and avoid connecting programming software to untrusted networks.
Johnson Controls recommends applying the latest available patches for affected Metasys versions. Metasys 15.0: patch released 2026-03-25. Metasys 14.1.5: forecast release 2026-07-15. Metasys 16.0: not impacted. Metasys 12 and 13: end of support, upgrade to later version. Additional measures: restrict network access to the Metasys UI to trusted networks, implement network segmentation, enforce least-privilege access controls, implement Content Security Policy headers, deploy a web application firewall, and monitor for suspicious URL patterns and script execution in access logs.
Rockwell Automation recommends updating affected firmware to the following corrected versions: V37.011, 34.015, 35.014, or 36.013 depending on the current platform version. Customers unable to upgrade should minimize network exposure, isolate control system devices behind firewalls, and ensure they are not accessible from the internet. Use VPNs for remote access and perform impact analysis prior to deploying defensive measures.
CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
CISA notes that CareCam has not responded to coordination attempts. Users are encouraged to contact CareCam for mitigation information. No official patch has been confirmed available. Recommended actions include isolating affected devices from untrusted networks where possible, monitoring for unusual device behavior, and applying additional network-level access controls until a firmware update or official guidance is released.
ABB recommends replacing the bundled MongoDB instance with a supported and patched version, or uninstalling IIoT Services where not required. Users should update MongoDB to versions at or above the patch thresholds (e.g., MongoDB Server v7.0.28+, v8.0.17+, v8.2.3+, v6.0.27+, v5.0.32+, v4.4.30+, v4.2.9+, v4.0.20+, v3.6.20+). Refer to ABB PSIRT advisory 9AKK108472A9037 and zenon online help for configuration guidance.
mySCADA Technologies has addressed these issues in Version 2.2. Users should update to the latest version via the application (if connected to the internet) or manually download from https://www.myscada.org/downloads/mySCADAPROManager/. CISA recommends minimizing network exposure, placing control system devices behind firewalls, and using VPNs for remote access.
Cisco urges all users of Cisco Catalyst SD-WAN Manager to upgrade to the fixed releases immediately. Because no workaround exists, upgrading to the patched version is the only recommended mitigation. Users should monitor Cisco advisories for specific version numbers and release notes.
Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at https://digital-watchdog.com/downloads/. Until firmware is applied, network segmentation and restricting FTP access may reduce risk.
Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at https://digital-watchdog.com/downloads/. Until firmware is applied, network segmentation and restricting FTP access may reduce risk.
Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at https://digital-watchdog.com/downloads/. Until firmware is applied, network segmentation and restricting FTP access may reduce risk.
Digital Watchdog has released updated firmware for the affected products. Users should download and install the updated firmware for their model at https://digital-watchdog.com/downloads/. Until firmware is applied, network segmentation and restricting FTP access may reduce risk.
Apply vendor-provided fixes for Fuel-Boss V1 Standard and Portal models. For Master/Slave and Backflush Systems, where fixes are unavailable or not planned, take systems offline or restrict IP access at the router level. Monitor vendor communications for future updates.
Update Siemens Solid Edge to V225.0.15 or later (SE2025) or V226.0.7 or later (SE2026). Apply patches from https://support.sw.siemens.com/product/246738425/. Restrict execution of untrusted PAR, PSM, and DFT files. Apply application whitelisting where possible.
Upgrade Malcolm to version 26.06.1 or later to address CVE-2026-55676. Upgrade to version 26.07.0 or later to address CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177. For CVE-2026-19670 and CVE-2026-19671, monitor CISA advisory for updates. Restrict access to the upload functionality to trusted users only.
Bendix recommends updating firmware to the most recent versions: Z300822 for Z228999 firmware revisions, Z302578 for Z266494 revisions, and Z302579 for Z286098 revisions. Users should contact Bendix at info@Bendix.com for assistance.
Organizations using Check Point VPN should monitor official Check Point advisories and apply security updates as released. Until patches are available, implement network segmentation and review VPN access controls to reduce attack surface.
Update ANDRITZ HIPASE-250/250 SCALA to version V8.15.00 or later. If immediate updating is not possible, network segmentation and monitoring of unauthorized access to device endpoints are recommended. Contact ANDRITZ at https://www.andritz.com/group-en/contact for patch guidance.
Hitachi Energy security advisory 8DBD000229 outlines recommended immediate actions. Affected organizations should verify GWS component presence, apply the latest software update from Hitachi Energy, and restrict network access to FCP management interfaces where possible. Deployments without the GWS component are not affected. Follow vendor guidance for patch testing in non-production environments prior to deployment.
Update affected devices to the latest firmware versions: Desigo DXR2 and PXC3 to V01.21.233.16-7862 or later; Desigo PXC4, PXC5.E003, PXC5.E24, and PXC7 to V02.21.194.36-2715 or later. Additionally, restrict network access to BACnet devices, isolate control networks from business networks, and use firewalls or VPNs for remote access.
Apply the fixes provided by Schneider Electric for each affected product version. Refer to the CSAF advisory for specific version thresholds and download links. Prioritize patching systems exposed to remote networks or used for critical infrastructure operations. Monitor for official Schneider Electric security bulletins for the latest patch availability and version-specific guidance.
Affected users should contact Zhibotong Electronics for firmware updates, implement network segmentation, and monitor for anomalous router behavior. Verify CVE assignments through official CNA processes. No official patch has been released as of disclosure.
Update ANDRITZ HIPASE-250/250 SCALA to version V8.15.00 or later. If immediate updating is not possible, network segmentation and monitoring of unauthorized access to device endpoints are recommended. Contact ANDRITZ at https://www.andritz.com/group-en/contact for patch guidance.
Update to TPDIN-Monitor-WEB3 Firmware v2.4.2. Units on v2.2.9 should apply the Intel HEX update: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex. Units already on v2.4.2 may use the signed container: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw. Contact Tycon Systems for additional support.
mySCADA Technologies has addressed these issues in Version 2.2. Users should update to the latest version via the application (if connected to the internet) or manually download from https://www.myscada.org/downloads/mySCADAPROManager/. CISA recommends minimizing network exposure, placing control system devices behind firewalls, and using VPNs for remote access.
Bendix recommends updating firmware to the most recent versions: Z300822 for Z228999 firmware revisions, Z302578 for Z266494 revisions, and Z302579 for Z286098 revisions. Users should contact Bendix at info@Bendix.com for assistance.
Organizations should apply vendor patches for PaperCut NG/MF as soon as available. Federal agencies must prioritize rapid remediation per Binding Operational Directive (BOD) 26-04. All organizations are encouraged to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. Check systems for compromise before applying patches per BOD 26-04 requirements.
Upgrade affected servers to AVEVA Enterprise SCADA v2025 P1 or higher, v2024 SP1 P2, v2023 SP1 P1, v2022 SP2 P3, or v2021 SP2 P6. Upgrade clients to AVEVA Enterprise SCADA HMI v2024 R2 HF7 or higher, v2024 P1, or v2023 P2 HF1. After upgrading, configure Server Components: change "BinarySerializer" -> "Mode" from 'Binary Formatter' to 'Json' and set "AcceptBinaryFormattedData" from 'true' to 'false', then re-cache the XOS Event Handlers assembly. Configure Client Components to use JSON serialization only. Refer to AVEVA KB117814 for step-by-step instructions.
Update PostgreSQL to the patched versions: 18.6, 17.11, 16.15, 15.19, or 14.24 or later. Apply the released security updates immediately. Review and restrict REPLICATION attribute assignments to trusted accounts only. Disable logical decoding if not required for your deployment.
Upgrade to OTTO Fleet Manager version 2.36.3 or later. Enable encrypted system backup as described in Rockwell Automation security advisory SD1791. If unable to upgrade, follow Rockwell's security best practices and minimize network exposure of control system devices. Use VPNs for remote access and isolate control system networks from business networks.
Siemens recommends contacting customer support for detailed fix information. Follow Fortinet advisory for workarounds. CISA advises minimizing network exposure, placing control systems behind firewalls, and using updated VPNs for remote access.
Update SIMATIC IoT2050 Advanced to version 4.3.4.1 or later. Harden the Node-RED installation following the Node-RED User Guide, or uninstall Node-RED if not required. Minimize network exposure by isolating control system devices behind firewalls and ensuring they are not internet-accessible. Use VPNs for remote access and keep VPN software updated.
Apply the latest PaperCut patches for CVE-2024-27198 and CVE-2024-27199. Monitor network traffic for indicators of compromise, especially from IP 45.142.193[.]132. Review access logs for unauthorized activity. Implement network segmentation and least-privilege access.
Apply vendor-provided fixes for Fuel-Boss V1 Standard and Portal models. For Master/Slave and Backflush Systems, where fixes are unavailable or not planned, take systems offline or restrict IP access at the router level. Monitor vendor communications for future updates.
Update ANDRITZ HIPASE-250/250 SCALA to version V8.15.00 or later. If immediate updating is not possible, network segmentation and monitoring of unauthorized access to device endpoints are recommended. Contact ANDRITZ at https://www.andritz.com/group-en/contact for patch guidance.
Apply vendor patches for CVE-2025-3866 immediately. Monitor for indicators of compromise associated with the JSP web shell. Restrict network access to Windchill and FlexPLM servers. Review logs for unauthorized JSP file deployment.
Users should immediately upgrade GitLab to the patched version as specified in the GitLab security advisory. Review GitLab's recommended upgrade paths for Community Edition and Enterprise Edition. Monitor official GitLab channels for any additional guidance or out-of-band patches.
Security teams should monitor Microsoft's security updates for CVE-2026-69414. Apply any released patches immediately. Implement network segmentation and application whitelisting to reduce the risk of malware evading Defender detections. Follow Microsoft's guidance on temporary mitigations if available.
Organizations should apply vendor patches for PaperCut NG/MF as soon as available. Federal agencies must prioritize rapid remediation per Binding Operational Directive (BOD) 26-04. All organizations are encouraged to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. Check systems for compromise before applying patches per BOD 26-04 requirements.
Rockwell Automation has released Redundancy Module Configuration Tool version 10.01.00 which addresses CVE-2026-9633 and CVE-2026-9634. Users are strongly advised to upgrade to the latest version immediately. Customers unable to upgrade should consult Rockwell Automation's security best practices and mitigation guidance published on the vendor's support portal and security advisories page. CISA recommends applying defensive measures outlined in advisory ICSA-26-244-02.
Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
Update Siemens License Server (SLS) to V5.1 or later for CVE-2026-69108 and V5.3 or later for CVE-2026-69109. Minimize network exposure, segment control system networks, and use VPNs for remote access. Follow Siemens operational guidelines for industrial security.
Apply SAP security updates released on 2026-09-09. Prioritize patching CVE-2026-44756 and any associated bundled vulnerabilities. Monitor SAP security advisories for additional guidance. Verify system compatibility before deploying patches in production environments.
Apply the latest Check Point security updates and firmware versions as specified in the vendor advisory. Review network segmentation and access controls for VPN appliances.
Rockwell Automation has released corrected versions. Customers unable to upgrade should follow security best practices at the Rockwell Automation support portal. CISA recommends minimizing network exposure, locating control system networks behind firewalls, isolating them from business networks, and using VPNs for remote access.