Latest Cybersecurity News, page 42

CCISA AdvisoriesinSecurity Advisories·Aug 20high

Siemens License Server Patched for Critical Privilege Escalation and Path Traversal Vulnerabilities

Siemens has released updates for the Siemens License Server (SLS) to address two actively tracked vulnerabilities. CVE-2026-69108 is a local privilege escalation flaw stemming from an insecure sudoers policy that could allow an attacker to execute arbitrary commands as root. CVE-2026-69109 is a path traversal vulnerability that could enable a remote attacker to read arbitrary files on the system. Both flaws affect SLS versions prior to 5.1 and 5.3 respectively, and Siemens recommends immediate updating to the latest released versions.

12m

CCISA AdvisoriesinCVE·Aug 20high

Critical Hard-Coded Credential Vulnerability in Flow Neuroscience FL-100 Brain Stimulation Devices

A critical vulnerability (CVE-2026-18164) affects Flow Neuroscience FL-100 and Halo Neuroscience FL-100 brain stimulation devices. An undocumented hard-coded credential, shared across all device units, permits attackers within Bluetooth range to bypass authentication. This could allow manipulation of brain stimulation parameters and override of safety limits, posing direct health risks to users. The advisory was published by CISA on August 13, 2026, following reporting by researcher A.C. Buglione. No public exploitation has been reported to date.

12m

CCISA AdvisoriesinCVE·Aug 20high

Siemens Solid Edge Multiple File Parsing Vulnerabilities

Siemens Solid Edge computer-aided design software is affected by seven file parsing vulnerabilities disclosed August 13, 2026. The flaws — including out-of-bounds reads and writes, and use-after-free issues — reside in the handling of specially crafted files in PAR, PSM, and DFT formats. Exploitation could allow an attacker to execute arbitrary code or crash the application in the context of the current process. All seven CVEs carry a CVSS v3.1 base score of 7.8 (HIGH). Siemens has released updated versions (SE2025 V225.0.15 or later; SE2026 V226.0.7 or later) and recommends immediate updating.

11m

CCISA AdvisoriesinCVE·Aug 20high

Siemens Solid Edge Multiple File Parsing Vulnerabilities - Seven CVEs Rated HIGH

Siemens Solid Edge versions SE2025 prior to V225.0.15 and SE2026 prior to V226.0.7 are affected by seven CVEs (CVE-2026-50058 through CVE-2026-50064) involving out-of-bounds read, out-of-bounds write, and use-after-free vulnerabilities in file parsing routines. The flaws are triggered when the application processes specially crafted files in PAR, PSM, or DFT format. Exploitation could allow an attacker to execute code in the context of the current process, crash the application, or potentially gain control of affected systems. CVSS v3.1 base scores are 7.8 (HIGH) for all seven vulnerabilities. Siemens has released updates and recommends immediate patching.

42m

CCISA AdvisoriesinCVE·Aug 20high

Siemens Parasolid Out-of-Bounds Read Vulnerability (CVE-2026-64629)

Siemens Parasolid, a widely used 3D geometric modeling kernel, is affected by an out-of-bounds read vulnerability (CVE-2026-64629) with a CVSS score of 7.8. The flaw occurs when the application parses specially crafted X_T format files. Exploitation could allow an attacker to crash the application or execute arbitrary code in the context of the current process. Siemens has released updated versions—V38.0.235 and V38.1.230—to address the issue. The vulnerability requires local access and user interaction to trigger.

11m

CCISA AdvisoriesinSecurity Advisories·Aug 20high

ANDRITZ HIPASE-250 and 250 SCALA Multiple Vulnerabilities Disclosed

CISA and ANDRITZ have disclosed four vulnerabilities affecting ANDRITZ HIPASE-250 and 250 SCALA industrial control system software versions 7.20 and earlier. The flaws span reversible password storage, unauthenticated data exposure, an undocumented logging-level endpoint, and a hard-coded x11vnc password in provisioning scripts. ANDRITZ has released patches in versions V8.00.00 (December 2024) and V8.15.00 (July 2026), urging users to update immediately.

12m

CCISA AdvisoriesinVulnerability·Aug 20critical

Critical OS Command Injection Vulnerability Discovered in Haiwell IoT Cloud HMI Gateway

A critical command injection vulnerability (CVE-2026-19188) has been identified in the Haiwell IoT Cloud HMI Gateway product. The flaw exists in the Net Check feature accessible via the /setting endpoint, where the cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system. Successful exploitation may allow an attacker to inject and execute arbitrary OS commands with root privileges. The vulnerability affects Haiwell IoT Cloud HMI Gateway version 3.40.1.12 and earlier. Haiwell has addressed the issue in patch version Scada-v3.50.1.19. The vulnerability has been reported to CISA by Fiqram Akmal. No known public exploitation has been reported to CISA at the time of publication. The vulnerability is classified as critical with CVSS scores of 3.1 and 4.0. Affected sectors include Energy, Critical Manufacturing, and Water and Wastewater.

42m