Latest Cybersecurity News, page 57

CCISA AdvisoriesinSecurity Advisories·Aug 20critical

Critical Vulnerabilities Discovered in Johnson Controls C-CURE 9000 and Victor Application Server

CISA and Johnson Controls have issued advisories regarding multiple critical vulnerabilities affecting C-CURE 9000 and Victor application server products. The vulnerabilities, primarily tracked as CVE-2026-21655, CVE-2026-34496, and CVE-2026-21653, involve server-side request forgery (SSRF) that could allow unauthenticated remote attackers to achieve arbitrary code execution, impact physical security controls, and facilitate lateral movement within networks. Affected versions span C-CURE 9000 up to v3.10.1, victor Application Server up to v4.10, victor up to v7.0, and victor Web up to v7.1. Johnson Controls has released vendor fixes recommending upgrades to newer versions to address the vulnerable deserialization paths.

32m

CCISA Advisoriesinvulnerability·Aug 20medium

Siemens RUGGEDCOM APE1808 Vulnerabilities Linked to Fortinet Flaws

Siemens has identified that the RUGGEDCOM APE1808 industrial gateway, when deployed with Fortinet NGFW, is affected by two vulnerabilities originally documented in Fortinet products. CVE-2026-23573 is a cross-site scripting flaw rated MEDIUM (CVSS 3.1: 6.1), and CVE-2026-59839 is a path traversal vulnerability also rated MEDIUM (CVSS 3.1: 5.5). Both vulnerabilities were reported to CISA by Siemens ProductCERT. Siemens recommends contacting customer support for detailed remediation information and advises following Fortinet's advisory for workarounds.

11m

KKrebs on SecurityinVulnerability·Aug 20high

Microsoft Releases Security Updates for 398 Vulnerabilities, Including Actively Exploited Flaw

Microsoft has released security updates to remedy at least 398 vulnerabilities in Windows operating systems and supported software. Among the patches, one vulnerability is reported as actively exploited in the wild, and two others were publicly detailed prior to today's release, increasing the risk of rapid weaponization. Users and organizations are advised to apply the updates immediately.

31m

CCISA AdvisoriesinSecurity Advisories·Aug 20high

Siemens License Server Patched for Critical Privilege Escalation and Path Traversal Vulnerabilities

Siemens has released updates for the Siemens License Server (SLS) to address two actively tracked vulnerabilities. CVE-2026-69108 is a local privilege escalation flaw stemming from an insecure sudoers policy that could allow an attacker to execute arbitrary commands as root. CVE-2026-69109 is a path traversal vulnerability that could enable a remote attacker to read arbitrary files on the system. Both flaws affect SLS versions prior to 5.1 and 5.3 respectively, and Siemens recommends immediate updating to the latest released versions.

22m

CCISA AdvisoriesinCVE·Aug 20high

Critical Hard-Coded Credential Vulnerability in Flow Neuroscience FL-100 Brain Stimulation Devices

A critical vulnerability (CVE-2026-18164) affects Flow Neuroscience FL-100 and Halo Neuroscience FL-100 brain stimulation devices. An undocumented hard-coded credential, shared across all device units, permits attackers within Bluetooth range to bypass authentication. This could allow manipulation of brain stimulation parameters and override of safety limits, posing direct health risks to users. The advisory was published by CISA on August 13, 2026, following reporting by researcher A.C. Buglione. No public exploitation has been reported to date.

12m

CCISA AdvisoriesinCVE·Aug 20high

Siemens Solid Edge Multiple File Parsing Vulnerabilities

Siemens Solid Edge computer-aided design software is affected by seven file parsing vulnerabilities disclosed August 13, 2026. The flaws — including out-of-bounds reads and writes, and use-after-free issues — reside in the handling of specially crafted files in PAR, PSM, and DFT formats. Exploitation could allow an attacker to execute arbitrary code or crash the application in the context of the current process. All seven CVEs carry a CVSS v3.1 base score of 7.8 (HIGH). Siemens has released updated versions (SE2025 V225.0.15 or later; SE2026 V226.0.7 or later) and recommends immediate updating.

31m

CCISA AdvisoriesinCVE·Aug 20high

Siemens Solid Edge Multiple File Parsing Vulnerabilities - Seven CVEs Rated HIGH

Siemens Solid Edge versions SE2025 prior to V225.0.15 and SE2026 prior to V226.0.7 are affected by seven CVEs (CVE-2026-50058 through CVE-2026-50064) involving out-of-bounds read, out-of-bounds write, and use-after-free vulnerabilities in file parsing routines. The flaws are triggered when the application processes specially crafted files in PAR, PSM, or DFT format. Exploitation could allow an attacker to execute code in the context of the current process, crash the application, or potentially gain control of affected systems. CVSS v3.1 base scores are 7.8 (HIGH) for all seven vulnerabilities. Siemens has released updates and recommends immediate patching.

62m

CCISA AdvisoriesinCVE·Aug 20high

Siemens Parasolid Out-of-Bounds Read Vulnerability (CVE-2026-64629)

Siemens Parasolid, a widely used 3D geometric modeling kernel, is affected by an out-of-bounds read vulnerability (CVE-2026-64629) with a CVSS score of 7.8. The flaw occurs when the application parses specially crafted X_T format files. Exploitation could allow an attacker to crash the application or execute arbitrary code in the context of the current process. Siemens has released updated versions—V38.0.235 and V38.1.230—to address the issue. The vulnerability requires local access and user interaction to trigger.

21m

CCISA AdvisoriesinSecurity Advisories·Aug 20high

ANDRITZ HIPASE-250 and 250 SCALA Multiple Vulnerabilities Disclosed

CISA and ANDRITZ have disclosed four vulnerabilities affecting ANDRITZ HIPASE-250 and 250 SCALA industrial control system software versions 7.20 and earlier. The flaws span reversible password storage, unauthenticated data exposure, an undocumented logging-level endpoint, and a hard-coded x11vnc password in provisioning scripts. ANDRITZ has released patches in versions V8.00.00 (December 2024) and V8.15.00 (July 2026), urging users to update immediately.

32m

CCISA AdvisoriesinVulnerability·Aug 20critical

Critical OS Command Injection Vulnerability Discovered in Haiwell IoT Cloud HMI Gateway

A critical command injection vulnerability (CVE-2026-19188) has been identified in the Haiwell IoT Cloud HMI Gateway product. The flaw exists in the Net Check feature accessible via the /setting endpoint, where the cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system. Successful exploitation may allow an attacker to inject and execute arbitrary OS commands with root privileges. The vulnerability affects Haiwell IoT Cloud HMI Gateway version 3.40.1.12 and earlier. Haiwell has addressed the issue in patch version Scada-v3.50.1.19. The vulnerability has been reported to CISA by Fiqram Akmal. No known public exploitation has been reported to CISA at the time of publication. The vulnerability is classified as critical with CVSS scores of 3.1 and 4.0. Affected sectors include Energy, Critical Manufacturing, and Water and Wastewater.

52m