Eclipse Foundation Eclipse Milo
CISA warns Eclipse Milo through 1.1.4 has six high-severity flaws; users should move to 1.1.5.
CISA published an ICS advisory for Eclipse Foundation's Eclipse Milo OPC UA implementation, affecting 0.6.0 through 1.1.4 or 1.0.0 through 1.1.4 depending on the bug. Six CVEs cover incorrect or missing authorization, unauthenticated memory exhaustion, and exposure of session diagnostics including usernames and authentication details. The highest stated CVSS v3.1 score is 8.2 for CVE-2026-58080. Eclipse recommends upgrading to Milo 1.1.5; 0.6.x has no fixed release, so those users must migrate. No exploitation is reported. Affected sectors include chemical, critical manufacturing, energy, and water.
- Six CVEs affect Eclipse Milo ranges from 0.6.0 or 1.0.0 through 1.1.4.
- Flaws include authorization bypass, memory exhaustion, and diagnostics exposure.
- CVE-2026-58080 has the highest listed CVSS v3.1 score, 8.2.
- Users should upgrade to Milo 1.1.5; 0.6.x must migrate.
- CISA cites chemical, manufacturing, energy, and water sectors.
- Vendors
- Eclipse Foundation
- Products
- Eclipse Milo
- Organizations
- CISAEclipse Foundation
- Countries
- Belgium
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60007 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other… | 9.1 group max | <1% |
From the original article
7 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Eclipse Milo are affected: Eclipse Milo >=0. 6.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.