Search: “update controller”

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-78225CVE-2026-81855

CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production

CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.

Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.

CSO Online·Sep 8, 17:16 UTC · 7d agoAdvisory in the wild

HITRUST improves quality, consistency, and efficiency of CSF assessments and reports

Help Net Security·Sep 6, 00:00 UTC · Sep 6, 2019Advisory

Attackers still exploit Log4Shell on VMware Horizon servers, CISA warns

Help Net Security·Jun 24, 00:00 UTC · Jun 24, 2022Advisory in the wildCVE-2021-44228CVE-2022-22954

CISA warns of critical flaws in Prima FlexAir access control system

Security Affairs·Aug 1, 06:12 UTC · Aug 1, 2019AdvisoryCVE-2019-7670CVE-2019-7669CVE-2019-7672+1 CVEs

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber Security·Sep 11, 15:56 UTC · 4d agoAdvisory2

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.

CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.

CISA Advisories·Sep 3, 12:00 UTC · 12d agoAdvisoryCVE-2026-4827

Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilitiesnew

Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.

Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.

GBHackers·05:36 UTC · 40m agoAdvisory

[Control systems] Advantech security advisory (AV26-907)

Canada's Cyber Centre flagged vulnerabilities in the Advantech WISE-6610 industrial gateway and urged users to apply available updates.

Advisory AV26-907, dated September 10, 2026, states that multiple versions and models of the Advantech WISE-6610 industrial gateway are affected by vulnerabilities. The Canadian Centre for Cyber Security encourages users and administrators to review the provided links and apply updates as they become available. No CVE identifiers or exploitation details were included in the announcement.

Canadian Centre for Cyber Security·Sep 10, 13:50 UTC · 5d agoAdvisory

Tycon Systems TPDIN-Monitor-WEB2 (Update A)

CISA details CVE-2026-61884 (CVSS 9.8) in Tycon Systems TPDIN-Monitor-WEB2: unauthenticated access to power relays when credentials are unset; fixed in 2.4.5.

CISA updated its advisory for Tycon Systems TPDIN-Monitor-WEB2 firmware below 2.4.5, covering two vulnerabilities. CVE-2026-61884 (CVSS 9.8, CWE-306) lets any network attacker reach full device controls, including power relay management and reboots, on units left without configured HTTP credentials. CVE-2026-55985 exposes stored system credentials in cleartext to authenticated dashboard users, enabling compromise of other local systems. No public exploitation has been reported to CISA.

CISA Advisories·Sep 3, 12:00 UTC · 12d agoAdvisory 2 sourcesCVE-2026-61884CVE-2026-55985

Slovakia Warns of Cyber Risks in Road Speed Cameras

Slovakia's NBÚ warns that speed camera systems from SODASUS, Simicon and NEROline pose cyber risks including undocumented remote access.

Slovakia's National Security Authority (NBÚ) warned of a significant cyber threat tied to several road speed camera products: NERO R-ONE units sold by Cyprus-based SODASUS, and Cordon-series cameras made by Russia's Simicon and sold by Croatia's NEROline. A security analysis requested by the Interior Ministry found weak protections, mismatches between documented and actual communication settings and software versions, unclear hardware/software provenance, and pre-configured remote-access mechanisms outside operator control. NBÚ warned that compromised cameras could expose vehicle and licence-plate data, tamper with records, or serve as a foothold into public-sector networks lacking segmentation. The Interior Ministry reportedly removed the units from its pilot deployment and asked the supplier to replace them with equipment meeting Slovak and EU security requirements.

Security Affairs·Aug 24, 08:54 UTC · 22d agoAdvisory

[Control Systems] Siemens security advisory (AV26-864)

Siemens fixed a vulnerability in Element maps-ng V47-V49 (SSA-682041); Canada's Cyber Centre urges administrators to apply the updated releases.

Siemens advisory SSA-682041 addresses a vulnerability affecting Element maps-ng V47 prior to V47.12.3, V48 prior to V48.11.3, and V49 prior to V49.16.1. Canada's Cyber Centre republished the notice (AV26-864) encouraging users and administrators to review the vendor links and apply the necessary updates. No CVSS score or exploitation details were provided in the bulletin.

Canadian Centre for Cyber Security·Aug 31, 15:59 UTC · 15d agoAdvisory

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor

Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.

Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.

Help Net Security·Sep 9, 09:04 UTC · 6d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69730+4 CVEs

[Control systems] GeoVision security advisory (AV26-913)

Canada's Cyber Centre (AV26-913) warns GeoVision GV-LPC2011/LPC2211 firmware 1.13 license-plate cameras are affected by vulnerabilities and urges updates.

The Canadian Centre for Cyber Security issued control-systems advisory AV26-913 on September 11, 2026, noting that GeoVision GV-LPC2011/LPC2211 firmware version 1.13 is affected by vulnerabilities. The bulletin references the vendor advisory GV-LPC-2026-09-01 but provides no CVE identifiers or exploitation details. Administrators are encouraged to review the linked advisories and apply updates as they become available.

Canadian Centre for Cyber Security·Sep 11, 15:38 UTC · 4d agoAdvisory

CISA Updates Insider Threat Guide With New Mitigation Advice

CISA updated its Insider Threat Mitigation Guide on September 9 with new case studies and guidance on hybrid work, AI and employee separations.

CISA published a revision of its Insider Threat Mitigation Guide, first issued in 2020, adding case studies, statistics and guidance for security, HR and leadership audiences. New material covers hybrid and remote work changes to physical and digital access, AI used to manipulate or deceive, access control, visitor screening and adverse employee separations. The agency framed the update around growing insider threat impact on critical infrastructure and pointed to preparedness resources for organizations without existing programs.

Infosecurity Magazine·Sep 10, 14:00 UTC · 5d agoAdvisory

[Control systems] Schneider Electric security advisory (AV26-912)

Canada's Cyber Centre relays a Schneider Electric advisory covering multiple vulnerabilities in EcoStruxure IT Data Center Expert and PowerLogic T300, urging users to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-912 noting that as of September 9, 2026 Schneider Electric is affected by vulnerabilities in EcoStruxure IT Data Center Expert versions 9.1.2 and prior, and PowerLogic T300 versions 2.9.8-5620 and prior. The issues include an improper neutralization of special elements used in an OS command on the PowerLogic T300. The advisory recommends reviewing vendor notifications, performing suggested mitigations, and applying necessary updates.

Canadian Centre for Cyber Security·Sep 11, 15:09 UTC · 4d agoAdvisory

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-81861

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA Advisories·Sep 10, 12:00 UTC · 5d agoAdvisoryCVE-2026-38059CVE-2026-38057CVE-2026-38056+1 CVEs

Hackers Strike Minnesota Water Utilities, One Plant Briefly Offline

Security Affairs·Jul 29, 19:31 UTC · Jul 29, 2026Advisory

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Ubuntu released USN-8748-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across networking, file system, and crypto subsystems.

Ubuntu issued security notice USN-8748-1 fixing several Linux kernel vulnerabilities affecting the NVIDIA Tegra memory controller driver, hardware crypto device drivers, and network drivers, among others. Affected subsystems include GFS2, OCFS2, and SMB file systems, B.A.T.M.A.N. meshing, Ceph, Netfilter, Open vSwitch, IPv4/IPv6, RxRPC, SCTP, and TIPC. An attacker could potentially exploit these flaws to compromise the system.

Ubuntu Security Notices·Sep 10, 15:32 UTC · 5d agoAdvisoryCVE-2026-52914CVE-2026-52931CVE-2026-52955+8 CVEs

CISA Warns of Critical ICS Flaws in Hitachi, mySCADA, ICL, and Nexx Products

The Hacker News·Apr 8, 04:44 UTC · Apr 8, 2023AdvisoryCVE-2022-3682CVE-2023-28400CVE-2023-28716+5 CVEs

Windows memory integrity switches on automatically for eligible devices in October 2026

Microsoft's Windows quality updates will automatically enable memory integrity and Virtualization-based Security on eligible devices starting October 2026.

Beginning in October 2026, Windows quality updates will automatically enable memory integrity on eligible devices and turn on Virtualization-based Security where it is not already running. Memory integrity restricts kernel-mode execution to trusted, signed code and drivers, blocking kernel compromise and rootkits. Microsoft said existing administrator decisions remain in effect, and readiness checks weigh hardware capability, compatibility, and performance. Memory integrity also underpins hotpatch updates that install without a reboot, so unprotected devices are excluded from that servicing model.

Help Net Security·Sep 3, 00:00 UTC · 13d agoAdvisory

Zuul reveals executive advisory board to drive company advancements

Help Net Security·Mar 11, 00:00 UTC · Mar 11, 2022Advisory

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2024-42384CVE-2024-42385CVE-2024-42386+11 CVEs

Kaspersky Security Bulletin: APT predictions 2024

Kaspersky Securelist·Nov 14, 10:00 UTC · Nov 14, 2023AdvisoryCVE-2020-35730CVE-2020-12641CVE-2021-44026+1 CVEs

August updates trigger 0xc0000409 errors on Windows Server 2016

Microsoft says the August 2026 security update causes recurring CompatTelRunner.exe 0xc0000409 crashes on Windows Server 2016 with Compatibility Appraiser enabled; no functional impact.

Microsoft confirmed a known issue in which the August 2026 Windows security update generates recurring Application Error events (Event ID 1000, exception code 0xc0000409) in CompatTelRunner.exe on Windows Server 2016. The issue affects physical and virtual machines, including VMware and Azure environments, and per Microsoft does not affect device functionality. A permanent fix is planned for a future update, and the event log entries can be dismissed temporarily.

BleepingComputer·Sep 8, 15:22 UTC · 7d agoAdvisory

AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn

NSA, CISA, FBI, DOE and EPA warn hackers are using AI-generated scripts to actively attack Siemens S7 PLCs across critical-infrastructure sectors.

A joint cybersecurity advisory from the NSA, CISA, FBI, Department of Energy and EPA warns of an active threat campaign targeting water, food, energy, chemical, manufacturing and commercial facilities via Siemens S7 Series programmable logic controllers. The actors use internet scanning to find exposed or poorly protected PLCs, then deploy AI-generated exploitation scripts disguised as legitimate monitoring tools, an OT first that dramatically lowers the expertise required for ICS attacks. Siemens says no new S7 vulnerabilities are involved, only exploitation of misconfigurations, and it is coordinating with CISA's ProductCERT. The warning follows a joint FBI-EPA advisory confirming attacks at water and wastewater utilities in at least 12 states since July 27.

CyberScoop·Aug 20, 14:00 UTC · 26d agoAdvisory in the wild1

Inductive Automation Ignition

CISA reports a permissions flaw (CVE-2026-77393, CVSS 8.8) in Inductive Automation Ignition <=8.1.53 letting authenticated users create projects; fixed in 8.1.54.

CISA republished Inductive Automation's advisory for CVE-2026-77393, an incorrect default permissions issue (CWE-276) in Ignition 8.1.53 and earlier. The Gateway "Create Project Role(s)" setting shipped blank, allowing any authenticated user who can execute gateway scripts to create projects. Ignition 8.1.54 restricts project creation to Designer sessions and the 8.3 series is unaffected. CISA notes no known public exploitation of this vulnerability.

CISA Advisories·Sep 3, 12:00 UTC · 12d agoAdvisoryCVE-2026-77393

CISA Adds Actively Exploited Linux Root Access Bug CVE-2026

The Hacker News·May 3, 06:26 UTC · May 3, 2026Advisory in the wildCVE-2026-31431

Siemens Mendix SAML

Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).

CISA republished Siemens advisory SSA-887643 for CVE-2026-80465 (CVSS 8.7) in the Mendix SAML module, affecting Mendix 10/11-compatible versions before 4.2.3 and Mendix 9.24-compatible versions before 3.6.27. The module improperly validates SAML response signatures (CWE-347), letting unauthenticated remote attackers hijack an account in specific SSO configurations. Mendix has released fixed versions and recommends updating.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-80465

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-58113

Kaspersky Security Bulletin, January

Kaspersky Securelist·Sep 22, 18:28 UTC · Sep 22, 2006AdvisoryCVE-2005-1921CVE-2005-0116CVE-2005-1950

CISA Adds Critical RocketMQ Bug to Must

Infosecurity Magazine·Sep 8, 10:00 UTC · Sep 8, 2023Advisory in the wildCVE-2023-33246

CareCam CM2507

CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.

CISA advisory ICSA-26-258-08 discloses seven vulnerabilities in CareCam HMT.CM2507 IP cameras running firmware v251211.1507. Issues include missing authentication for network video streaming (CVE-2026-88259, CVSS 3.1 7.5), an empty password on a privileged ONVIF account (CVE-2026-84398), weak legacy hashing of the root password (CVE-2026-85497, CVSS 4.0 9.3 critical), and cleartext storage of Wi-Fi credentials (CVE-2026-81321). Physical-access flaws allow arbitrary code execution from scripts on removable media (CVE-2026-81305) and unauthenticated bootloader access (CVE-2026-85478). The cameras are deployed worldwide in commercial facilities.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-88259CVE-2026-84398CVE-2026-84400+4 CVEs

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-73807CVE-2026-82567

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA Advisories·Sep 15, 12:00 UTC · 18h agoAdvisoryCVE-2026-68953CVE-2026-66890CVE-2026-68070+3 CVEs

NextGen Healthcare Mirth Connect

CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.

CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.

CISA Advisories·updated Sep 11, 13:08 UTC · 4d ago·first Sep 10, 12:00 UTC · 5d agoAdvisory 2 sourcesCVE-2026-82583CVE-2026-78224CVE-2026-82578

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA Advisories·Sep 10, 12:00 UTC · 5d agoAdvisoryCVE-2026-87020

AVEVA Pipeline Integrity Monitor

CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.

CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.

CISA Advisories·Sep 10, 12:00 UTC · 5d agoAdvisoryCVE-2026-81821CVE-2026-81822CVE-2026-81823+1 CVEs

CareCam Pro IP Cameras

CISA advisory details hard-coded bootloader credential CVE-2026-85083 in ANJIA AJL33PC0801 CareCam Pro cameras, allowing physical-access firmware compromise.

CISA ICS advisory ICSA-26-251-01 describes CVE-2026-85083, a hard-coded credential (CWE-798) used for bootloader authentication in the ANJIA AJL33PC0801 CareCam Pro IP camera. An attacker with physical access could gain privileged bootloader access and modify firmware and configuration, potentially fully compromising the device. The flaw scores 6.8 on CVSS 3.1 (7.0 on CVSS 4.0), is not remotely exploitable, and no public exploitation has been reported. Affected firmware is linux_linux_202008261138_svn13796 with U-Boot 2010.06; the vendor is headquartered in China with worldwide deployments.

CISA Advisories·Sep 8, 12:00 UTC · 7d agoAdvisoryCVE-2026-85083