Search/abb
Known CVEs
0
Highest CVSS
—
In KEV
0
Vendor
cp665 firmware
Connections
232 relationships
Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility
Poland’s computer emergency response team (CERT) has published a report detailing a second attack on the country’s power grid. The attackers targeted industrial control systems (ICS) and their objective was “purely destructive”. In late December 2025, threat actors linked to the Russian government, specifically the APT named Sandworm, targeted communication and control systems at roughly 30 sites, including combined heat and power (CHP) plants and renewable energy dispatch centers for wind and solar facilities. In that attack, the hackers gained access to ICS, but mainly targeted grid safety and stability monitoring systems rather than active power generation systems. While some ICS devices were permanently damaged, the attack did not cause any electrical outages. In a report published over the weekend, CERT.PL revealed that the country’s energy sector was targeted in a second attack in December 2025. An investigation revealed that this attack, conducted in parallel with the previously disclosed hack, was aimed at a smaller CHP plant supplying heat to 50,000 residents. The Polish CERT’s report highlights that this appears to be the first time threat actors used a private APN as an attack vector, warning that the same vulnerable configuration has been commonly encountered in Poland and other countries around the world. The cyberattack caused the shutdown of a steam turbine and a water treatment system, which resulted in a disruption of the cogeneration process. However, the systems were quickly restored, and heat and electricity supply were not interrupted. The attack occurred during maintenance work, and it was initially believed that an engineering error had led to the disruption, but the CERT soon determined that it was the result of hacker activity. From an edge device to an energy facility’s OT network The intrusion started on a Fortinet VPN and firewall device located at a wind farm and connected to the internet. The hackers then identified a Teltonika cellular router on the same network and accessed its admin interface. An SSH service running on the device was then used to establish a tunnel that enabled communication to a private APN network managed by the distribution system operator (DSO). These private APN networks enable communication between the DSO’s SCADA system and ICS installed at the substation. The attacker scanned the private APN network and identified a Wago programmable logic controller (PLC) running at a CHP plant. An SSH service enabled on this controller gave the attacker access to the plant’s operational technology (OT) networks. After conducting reconnaissance over the course of one week, the threat actor connected to Siemens PLCs, switched them to ‘stop’ mode, and set a password to prevent operators from changing the controllers’ operating state and control logic. These actions caused the shutdown of the steam turbine and water treatment systems. Staff managed to limit the downtime by resetting the affected PLCs to their factory settings and reloading logic from backups. Moxa serial device servers and Moxa network switches were also targeted by the attackers and configured to prevent the legitimate operators from accessing them. ABB and Schneider Electric variable frequency drives were also targeted by the attackers, but it’s unclear what actions they carried out on these devices, and some attempts to connect to them were unsuccessful. Similar to the attack on the first energy facility, the hackers bricked some of the compromised ICS devices. According to the Polish CERT, some devices were permanently damaged as part of the attackers’ attempts to cover their tracks. “The attacker then damaged the WAGO controller that had been used as a gateway into the network by corrupting its partition table, preventing it from being read by the device. In an attempt to restore the controller, the affected entity performed a factory reset; however, this did not repair the partition table and the device remained unable to boot. No valuable logs could be recovered from the device during the investigation.” Related: Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix Related: Water Sector Cyberattacks Reportedly Hit at Least 12 States
securityweek.comAug 10, 2026extracted
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Rockwell
Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published July 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products. Siemens published nine new advisories, including six that cover critical vulnerabilities (based on CVSS score). A CVSS score of 10 has been assigned to a token invalidation vulnerability in Opencenter X that allows an attacker to bypass authentication and gain full access to the application. Critical vulnerabilities have also been patched or mitigated by Siemens in Mendix, Sidis Secured SmartPlug, Simatic S7-1500, Cadra, and Desigo CC. The security holes, many of which affect third-party components, can be exploited to launch DoS attacks, execute code, obtain sensitive data, and escalate privileges. Siemens addressed high-severity vulnerabilities in Simatic S7-PLCSIM, Ruggedcom APE1808, Comos, Designcenter, Simcenter, Solid Edge, and Tecnomatrix products. Schneider Electric has released two new advisories. One of them addresses a high-severity vulnerability in the IGSS (Interactive Graphical SCADA System) product. An attacker can use specially crafted files to execute arbitrary code. The second advisory describes a high-severity authentication bypass flaw in EcoStruxure Cybersecurity Admin Expert that can be exploited by a local attacker to compromise managed devices. Rockwell Automation published 12 new advisories on Tuesday, including two covering critical vulnerabilities. A critical vulnerability in the 1715 Redundant IO product can allow an unauthenticated attacker to access intrusive CLI commands, enabling them to read or delete files, stop tasks, change IO states, and modify memory. Three critical DoS security holes that can be exploited to cause a major non-recoverable fault have been patched by Rockwell in its CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers. Rockwell patched high-severity vulnerabilities in Flex 5000 Adapter, FactoryTalk DataMosaix, FactoryTalk Services Platform, Arena, ThinManager, Studio 5000 Logix Designer, 1756-EN, 1734 POINT I/O, and 1719-AENTR products. ABB and Mitsubishi Electric have not published any new advisories this Patch Tuesday, but they have informed customers of new flaws over the past month, including critical and high-severity issues. Three ABB advisories and one Rockwell advisory were also distributed by the cybersecurity agency CISA on Tuesday. Germany’s VDE CERT has published five new advisories covering vulnerabilities in Murrelektronik, Mettler Toledo, Codesys, and Wago products. Related: ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact Related: ICS Patch Tuesday: 8 Industrial Giants Publish New Security Advisories
securityweek.comJul 15, 2026extracted
Underwater, Fincantieri crea un polo con quattro nuove acquisizioni da 600 milioni di euro
Una operazione che per Fincantieri trasforma “in modo significativo il proprio posizionamento in un segmento sempre più centrale per la sicurezza, l’energia e lo sviluppo delle infrastrutture critiche“. Poker di acquisizioni nel settore underwater per Fincantieri che crea così un grande polo della subacquea. Rilevate Next Geosolutions, WSense, Graal Tech e Defcomm. Una operazione che per Fincantieri trasforma “in modo significativo il proprio posizionamento in un segmento sempre più centrale per la sicurezza, l’energia e lo sviluppo delle infrastrutture critiche”. La Borsa risponde con un +12% al poker di acquisizioni. Ha così risvegliato un titolo che solo pochi giorni fa era tornato ai minimi da più di un anno sul timore di uno stallo di alcuni programmi militari. Le quotazioni si attestano a 12,2 euro. Di questi temi si parlerà in occasione della 3^ edizione di Space and Underwater, la Conferenza internazionale organizzata e promossa da Cybersecurity Italia in collaborazione con ASI, il prossimo 3 dicembre presso l’Auditorium Luigi Broglio. Nasce il primo operatore verticalmente integrato della subacquea Nasce così il primo operatore verticalmente integrato della subacquea, con 8 realtà specializzate nelle loro rispettive attività. Realtà in grado di orchestrare soluzioni end-to-end integrate lungo tutta la catena del valore in maniera sinergica. Dall’hardware al software e alle telecomunicazioni, dalla fornitura di mezzi subacquei all’erogazioni di servizi, beneficiando di cross-selling, sviluppo prodotti congiunto, economie di scala e di scopo. Si accelera così la strategia del segmento underwater indicata nel Piano Industriale 2026-2030. L’operazione segue le acquisizioni di Wass e Remazel nel 2024 e 2025 Questa operazione segue l’acquisizione e l’integrazione con successo di Wass nel 2025 e Remazel nel 2024 e costituisce l’impiego del capitale raccolto con l’operazione di capitale in ABB conclusa con successo nello scorso febbraio grazie a condizioni di mercato favorevoli. “L’operazione odierna rappresenta una trasformazione industriale storica per Fincantieri, che crea un campione internazionale dell’Underwater, grazie alla completa integrazione lungo la catena del valore di tecnologie, competenze e capacità operative”, commenta l’ad di Fincantieri, Pierroberto Folgiero. “Queste acquisizioni – prosegue – ci consentono inoltre di accelerare nell’attuazione del Piano Industriale, rafforzando in modo significativo la redditività e valorizzando un mercato in forte espansione, dove la componente dual-use è destinata a diventare sempre più rilevante. Abbiamo inoltre scelto di valorizzare la continuità industriale delle società acquisite, mantenendo i management team esistenti, perché riteniamo che competenze ed execution siano un elemento essenziale della crescita del Gruppo”. L’operazione è finanziata dalle somme raccolte con l’aumento di capitale da 500 milioni di euro completato con successo a febbraio 2026 integrate da altre fonti disponibili del Gruppo, senza impatto sulla guidance di PFN/Ebitda per il 2026 e migliorando i target di PFN/EBITDA per il 2028 e 2030 indicati nel Piano Industriale 2026 -2030. Ricavi pro forma del 2026 da 1,1 miliardi Su base pro-forma il segmento underwater raggiunge nel 2026 ricavi per 1,1 miliardi di euro, Ebitda per 220 milioni di euro, conseguendo con 4 anni di anticipo i target di crescita underwater previsti al 2030 nel piano industriale 2026 -2030 presentato a febbraio 2026; le acquisizioni contribuiscono all’utile di gruppo pro-forma 2026 per oltre 60 milioni di euro aggiuntivi. Le acquisizioni sono altamente accrescitive per il gruppo con un aumento del EPS del 30% al 2028 e del 20% al 2030 A livello di gruppo le acquisizioni consentono di incrementare l’Ebitda 2026 pro-forma del 13% e l’utile netto 2026 pro-forma del 40%. Gli analisti Secondo gli analisti di Intermonte, le operazioni sono da valutare positivamente in quanto coerenti con quanto annunciato in occasione dell’aumento di capitale e finalizzate a rafforzarsi in un business a marginalità superiore e a potenzialità di crescita superiore rispetto alle altre divisioni del gruppo. Il deal, secondo quanto annunciato dalla società, avrà un impatto accrescitivo sugli utili rilevante visto che è atteso aumentare di 60 milioni l’utile proforma 2026 di gruppo e di 130 milioni quello del 230. Sarà inoltre neutrale per quanto riguarda la leva finanziaria visto l’utilizzo dei proventi dell’aumento. Per questi fattori Intermonte si aspetta una revisione del consensus delle case di investimenti per il periodo 2026-30. Per Equita Sim (che ha affiancato Fincantieri nella fairness opinion sull’operazione WSense) “le operazioni rafforzano il posizionamento nel segmento underwater (stimiamo gia’ nel 2026 un contributo pro forma dell’11% al fatturato di gruppo ma di circa il 30% sull’ebitda) che offre importanti prospettive di crescita e amplia l’offerta permettendo a Fincantieri di entrare nel settore dei servizi”. La conclusione delle acquisizioni – aggiunge la Sim – “fanno venir meno l’incertezza legata all’operazione di aumento di capitale di febbraio indicando chiaramente l’allocazione dei proventi”. Loperfido (Fdi): “Polo Underwater di Fincantieri orgoglio nazionale e riferimento europeo“ Emanuele Loperfido, deputato di Fratelli d’Italia e componente della commissione Difesa ha commentato l’operazione. In questi termini: “La nascita del polo Underwater di Fincantieri rappresenta un’operazione di grande valore strategico, motivo di orgoglio per l’Italia e, in particolare, per il Friuli Venezia Giulia. Il nostro Paese potrà essere sempre più punto di riferimento europeo nelle infrastrutture e nei servizi di supporto alla Difesa. L’integrazione tra più aziende, il coinvolgimento di circa 1.500 professionisti altamente qualificati, università, startup di settore e imprese manifatturiere dà vita a una filiera completa che va dalla ricerca al prodotto finito, fino ai servizi. Significa innovazione, occupazione qualificata ed export in uno dei mercati più strategici e in più rapida crescita. Fincantieri entra così nell’élite dei gruppi mondiali capaci di offrire l’intera gamma di soluzioni per la subacquea: droni, sensori, sistemi di comunicazione e servizi. Proteggere le infrastrutture critiche sottomarine significa proteggere ciò da cui dipendono la nostra vita quotidiana e l’economia nazionale“. E ancora: “Il 99% del traffico Internet mondiale viaggia attraverso i cavi sottomarini, così come sono strategici gasdotti, rigassificatori e cavi elettrici. In uno scenario internazionale sempre più instabile, rafforzare la capacità di proteggere queste infrastrutture è una scelta fondamentale“.
cybersecitalia.itJul 6, 2026extracted
Digi International’s DANI automates network diagnostics and device management
Digi International’s DANI automates network diagnostics and device management Digi International has announced the launch of DANI, the Digi Artificial Network Intelligence agent, a purpose-built AI network operations agent natively embedded in a networking device management platform, Digi Remote Manager (DRM). Embedded directly within DRM as a value-added service, DANI enables network operators and managed service providers to monitor and diagnose network issues, identify root causes and surface recommended actions through a single conversational interface. Unlike third-party AI tools layered onto generic platforms, DANI operates from within the same system that manages the devices themselves. This native integration, built on Model Context Protocol (MCP), gives DANI direct access to real-time device telemetry, cellular signal data, firmware state and configuration history. No external AI agent can replicate this level of context. The result is faster, more accurate diagnostics with no data movement, no additional credentials and no gap between insight and action. Platform of innovation DANI is the next step in a broader platform evolution. Over the past year, Digi has invested in foundational capabilities that make AI-driven network operations possible at scale, including Digi eSIM, which enables flexible, programmable connectivity for distributed device deployments, and Digi Remote Reach, which gives operators secure out-of-band, on-demand access to remote devices for real-time diagnostics and remediation. These capabilities are part of the operational backbone on which DANI’s intelligence runs, turning insights into actions across the full device lifecycle. Industrial networks are expanding rapidly as organizations connect more devices across distributed environments, raising expectations for uptime and performance. According to ABB’s Value of Reliability report, two-thirds of industrial companies experience unplanned downtime at least once a month, at a cost of $125,000 per hour. Despite this pressure, IT and OT teams remain constrained, forcing operators into time-consuming, reactive workflows that rely on alerts, manual log analysis and fragmented data across systems. DANI addresses this challenge by embedding AI-driven intelligence directly at the point of action. Operators can ask DANI questions in natural language and receive clear, actionable guidance without switching tools or interpreting raw data, enabling a shift from reactive troubleshooting to proactive, AI-assisted network operations. “AI is reshaping how critical infrastructure is managed, and the next phase of networking will be defined by systems that can interpret, decide and even act in real time, if given explicit permissions. DANI represents a foundational shift for industry. By embedding AI directly into the operational fabric of our cloud platforms, we are moving beyond visibility in a major step toward true network autonomy, giving operators the context, scale, and real-time insight needed to transform how networks are managed. This truly reduces the cost and complexity to deploy, manage and support new networks,” said Tony Puopolo, President, Digi Managed Solutions. DANI is designed specifically for the Digi ecosystem, with deep understanding of device telemetry, network behavior and operational workflows. It operates directly within the platforms customers already use to manage their device fleets, embedding AI-driven intelligence at the point of action to streamline operations and accelerate decision-making. For example, an operator managing a fleet of 500 devices could reduce their diagnostic time from hours to minutes. DANI delivers a set of capabilities designed for real-world network operations: Conversational diagnostics and guidance that allow operators to ask questions in plain language and receive clear, actionable answers without manual log analysis Continuous device health monitoring that identifies anomalies early and surfaces potential issues before they impact operations Intelligent recommendations for firmware updates, configuration fixes and performance optimization based on real-time network data Automated execution of routine management tasks to reduce manual workload and improve consistency across device fleets Multi-tenant support for managed service providers managing large-scale deployments across multiple customers Native integration within Digi Remote Manager, with no additional infrastructure, separate login or data movement required For Digi International, DANI represents the intelligent layer on top of a platform purpose-built for modern network operations. Customers benefit from faster mean time to resolution, reduced operational workload and the ability to scale device management without adding headcount, all within the platforms and connectivity infrastructure they already rely on.
helpnetsecurity.comJun 30, 2026extracted
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact
ICS Patch Tuesday advisories were published this month by Siemens, Schneider Electric, and Phoenix Contact. Siemens published only four new advisories. In Sinec INS, the industrial giant fixed authenticated command execution, information disclosure, privilege escalation, and password exposure flaws. The company also addressed a DoS and potential code execution issue in Siprotec 5, and a sensitive information exposure weakness in WinCC Certificate Manager. Siemens also patched CVE-2025-15467, an OpenSSL vulnerability allowing remote code execution, in Scalance, Simatic, Sinamics, Sinec, and other products. Schneider Electric published three new advisories. They cover DoS and command execution vulnerabilities in PowerLogic P7, credential exposure issues in EasyLogic T150 and Saitel DP Remote Terminal Unit & Controller, and an information disclosure issue in EcoStruxure IT Data Center Expert. Phoenix Contact published one new advisory to inform customers about an unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers. CISA and Germany’s VDE CERT have also published some vendor advisories. CISA informed organizations about previously disclosed Schneider and Siemens flaws, while VDE CERT released advisories for LabX Standard and MBS security holes. Rockwell Automation did not issue any new security advisories on Tuesday, but it announced enhancements to its SecureOT solution suite, including the OT Cybersecurity Assessment Suite, SecureOT Platform Managed Services, and Managed Secure Remote Access (MSRA). ABB and Mitsubishi Electric have each published a couple of new advisories over the past month. Related: Real-World ICS Security Tales From the Trenches Related: Critical Vulnerability Exposes Industrial Robot Fleets to Hacking Related: ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA
securityweek.comJun 10, 2026extracted
NIS2 e governance aziendale: le nuove responsabilità dei board nella cyber security
L’evoluzione della minaccia informatica e la necessità di proteggere il tessuto industriale nazionale hanno portato la gestione del rischio digitale al centro delle strategie di vertice. Durante la sessione dedicata alle nuove sfide cyber per la rivoluzione OT, svoltasi nell’ambito del Security Summit Milano 2026 e promossa dalla community Women For Security, è emerso con chiarezza come il recepimento della direttiva NIS2 stia segnando il passaggio definitivo da una conformità puramente documentale a una responsabilità diretta dei vertici aziendali. Le testimonianze dei relatori confermano che la normativa non deve essere interpretata come un onere burocratico, bensì come un perimetro strutturato capace di guidare le organizzazioni verso una resilienza autentica, in grado di tutelare la continuità operativa dei servizi essenziali per il cittadino. Indice degli argomenti La NIS2 come acceleratore di investimenti e ordine organizzativo Uno dei punti cardine emersi dal confronto tra i responsabili della sicurezza riguarda il valore strategico della normativa nel dialogo con la dirigenza. Per Rosaria Di Fiore, di ASST Ovest Milanese, la direttiva rappresenta un supporto fondamentale per gestire la complessità derivante dalla digitalizzazione forzata degli ultimi anni. Di Fiore sottolinea, infatti, che: «La forte evoluzione digitale comporta un rischio di caos; la NIS2 crea ordine, obbligando a seguire processi e indirizzando tutti gli attori coinvolti». Questa visione è condivisa anche dal settore industriale, dove la tecnologia operativa richiede tempi di intervento e approcci profondamente diversi dall’informatica tradizionale. Ivan Monti, di Ansaldo Energia, evidenzia come l’introduzione di standard normativi stringenti abbia finalmente spostato l’attenzione dei consigli di amministrazione sulla protezione degli impianti. Prima dell’attuale assetto normativo, era complesso ottenere l’attenzione dei board o dei colleghi dell’automazione, focalizzati quasi esclusivamente sulla produzione costante. Il cambiamento di paradigma è misurabile nei numeri: Monti dichiara che «senza la NIS2 sarebbe stato impossibile ottenere l’attenzione del board» e riporta che, proprio grazie a questo nuovo scenario, il budget destinato alla sicurezza OT è cresciuto di 20 volte rispetto a soli cinque anni fa. Il ruolo dell’Agenzia per la Cybersicurezza Nazionale e la finestra di adeguamento Al centro dell’ecosistema normativo italiano si colloca l’Agenzia per la Cybersicurezza Nazionale (ACN), il cui approccio è orientato più alla guida che alla mera attività sanzionatoria. Milena Antonella Rizzi, Capo Servizio Regolazione dell’ACN, chiarisce che l’obiettivo del regolatore non è pretendere un allineamento istantaneo di sistemi che presentano gap tecnologici di vent’anni rispetto all’IT. L’Agenzia ha messo a disposizione linee guida e FAQ per supportare i soggetti obbligati in questo percorso di transizione. Un aspetto cruciale per le aziende riguarda i tempi della registrazione e l’opportunità di sfruttare la fase attuale per correggere le proprie posture di sicurezza. Milena Antonella Rizzi spiega, infatti, che: «Farlo ora permette di usufruire di un “periodo di grazia” mentre le norme vengono scritte; chi si registrerà nel 2027 sarà immediatamente tenuto al rispetto totale». L’obbligo di registrazione non riguarda solo i gestori diretti di infrastrutture critiche, ma si estende anche a quei soggetti che forniscono servizi IT a società controllate operanti in settori strategici. Responsabilità legali dei vertici e l’art. 23 La NIS2 introduce un legame indissolubile tra la pianificazione della sicurezza e la responsabilità dei vertici. Milena Antonella Rizzi richiama l’attenzione sull’Allegato C e sulla necessità che le pianificazioni di sicurezza siano formalmente approvate dai board ai sensi dell’articolo 23. La mancanza di tali atti formali non rappresenta solo una lacuna tecnica, ma una violazione normativa che «sarà facilmente sanzionabile» dalle autorità competenti. Questo elemento trasforma la cybersecurity in una componente essenziale della responsabilità d’impresa, obbligando i dirigenti a una conoscenza attiva dei rischi cyber cui è esposta l’organizzazione. Frammentazione normativa e criticità della supply chain Nonostante gli sforzi di armonizzazione della NIS2, permangono ambiti in cui il quadro regolatorio risulta ancora frammentato, creando difficoltà operative per le imprese. Bruno Ceradelli, di GNV, cita l’esempio del settore marittimo, dove convivono le norme della direttiva NIS dal 2020 con le regolazioni dell’IMO e le circolari del Comando Generale del Corpo delle Capitanerie di Porto. Ceradelli evidenzia che tali normative spesso «non sono esattamente integrate, creando attrito interpretativo». La proposta di una gestione più centralizzata sotto l’egida dell’ACN viene vista come una possibile soluzione per semplificare la compliance. Un ulteriore fronte di attenzione è quello della supply chain e della gestione dei fornitori terzi. In contesti complessi come quello navale o sanitario, i produttori di componenti critiche, come ABB, iniziano ad adeguarsi alle nuove richieste del mercato. Tuttavia, il processo è lento e richiede una forte azione di “moral suasion” supportata dalla normativa. Milena Antonella Rizzi sottolinea che, sebbene la Commissione Europea parli di semplificazione attraverso proposte come la Single Entry Platform per ridurre i costi, per l’autorità italiana la sicurezza deve essere considerata prima di tutto un investimento e non un mero adempimento al ribasso. Cultura della sicurezza e consapevolezza collettiva L’efficacia della NIS2 non dipende esclusivamente dai regolamenti e dalle tecnologie, ma anche dal grado di consapevolezza diffuso all’interno delle organizzazioni e nella società. Anna Vaccarelli, rappresentante di Clusit e Women For Security, ribadisce l’importanza di diffondere una cultura della sicurezza che parta dai giovani fino ad arrivare agli adulti e ai giornalisti generalisti. Fornire strumenti corretti per interpretare i fatti di cronaca legati alla cybersecurity è considerato un passo essenziale per evitare allarmismi e promuovere una gestione razionale del rischio. In questa direzione si muovono anche le iniziative di monitoraggio della consapevolezza nel settore OT. Cinzia Ercolano, fondatrice di Women For Security, ha annunciato l’avvio di una survey specifica, curata insieme alla Prof.ssa Paola Girdinio e Georgia Cesarone, volta a misurare il livello di maturità e awareness delle aziende italiane rispetto alle sfide della tecnologia operativa. L’integrazione tra competenze tecniche, quadri normativi come la NIS2 e una forte leadership consapevole appare dunque come l’unica via percorribile per garantire la tenuta delle infrastrutture nazionali di fronte alle minacce del futuro.
cybersecurity360.itMay 27, 2026extracted
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Ivanti, Fortinet, n8n, SAP, and VMware have released security fixes for various vulnerabilities that could be exploited by bad actors to bypass authentication and execute arbitrary code. Topping the list is a critical flaw impacting Ivanti Xtraction (CVE-2026-8043, CVSS score: 9.6) that could be exploited to achieve information disclosure or client-side attacks. "External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks," Ivanti said in an advisory. Fortinet published advisories for two critical shortcomings affecting FortiAuthenticator and FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that could result in code execution - CVE-2026-44277 (CVSS score: 9.1) - An improper access control vulnerability in FortiAuthenticator that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. (Fixed in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3) CVE-2026-26083 (CVSS score: 9.1) - A missing authorization vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that may allow an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. (Fixed in FortiSandbox versions 4.4.9 and 5.0.2, FortiSandbox Cloud version 5.0.6, and FortiSandbox PaaS versions 4.4.9. and 5.0.2) SAP also shipped fixes for two critical vulnerabilities - CVE-2026-34260 (CVSS score: 9.6) - An SQL injection vulnerability in SAP S/4HANA CVE-2026-34263 (CVSS score: 9.6) - A missing authentication check in the SAP Commerce cloud configuration "The vulnerability is caused by an overly permissive security configuration with improper rule ordering, allowing an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution," Onapsis said about CVE-2026-34263. On the other hand, CVE-2026-34260 could be exploited by an attacker to inject malicious SQL statements and potentially impact the confidentiality and availability of the application. However, since the affected code only allows read access to data, the vulnerability does not compromise the integrity of the application. "It allows a low-privileged, authenticated attacker to inject malicious SQL code via user-controlled input, potentially exposing sensitive database information and crashing the application," Pathlock said. Patches have also been released by Broadcom for a high-severity flaw in VMware Fusion (CVE-2026-41702, CVSS score: 7.8) that could pave the way for local privilege escalation. The issue has been addressed in version 26H1. "VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary," Broadcom said. "A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed." Round off the list is a set of five critical vulnerabilities impacting n8n - CVE-2026-42231 (CVSS score: 9.4) - A vulnerability in the xml2js library used to parse XML request bodies in n8n's webhook handler that allows prototype pollution via a crafted XML payload, enabling an authenticated user with permission to create or modify workflows to achieve remote code execution on the n8n host. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-42232 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node, leading to remote code execution when combined with other nodes exploiting the prototype pollution. (Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1) CVE-2026-44791 (CVSS score: 9.4) - A bypass for CVE-2026-42232 that could result in remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44789 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node, leading to remote code execution on the n8n host. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) CVE-2026-44790 (CVSS score: 9.4) - An authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation, enabling an attacker to read arbitrary files from the n8n server and resulting in full compromise. (Fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1) Software Patches from Other Vendors Security updates have also been released by other vendors over the past several weeks to rectify various vulnerabilities, including - ABB Adobe Amazon Web Services AMD Apple ASUS Atlassian Axis Communications AVEVA Canon Cisco CODESYS ConnectWise Dell Devolutions Drupal F5 Fortra Foxit Software Fujitsu GitLab GnuTLS Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Intel Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Meta WhatsApp Microsoft Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NVIDIA OPPO Palo Alto Networks Phoenix Contact Phoenix Technologies Progress Software QNAP Qualcomm React Ricoh Samsung Schneider Electric Siemens Sophos Spring Framework Supermicro Synology Tenable TP-Link WatchGuard Zoom, and Zyxel
thehackernews.comMay 18, 2026extracted
ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA
Only Siemens, Schneider Electric, CISA, and CERT@VDE have published new ICS security advisories for the May 2026 Patch Tuesday. Siemens has published 18 new security advisories, and several of them describe critical vulnerabilities. The company has addressed critical issues in Sentron 7KT PAC1261 Data Manager (device takeover), Simatic S7 PLC web server (XSS), Ruggedcom Rox (command execution as root, old vulnerabilities in third-party components), ROS# (arbitrary file access), Simatic CN4100 (over 300 third-party component flaws), and Opcenter RDnL (missing authentication). Siemens has also informed customers that its Ruggedcom APE1808 product is affected by the recently disclosed Palo Alto Networks PAN-OS vulnerability that has been exploited in the wild, possibly by Chinese state-sponsored hackers. High-severity vulnerabilities that can be exploited for remote code execution have been resolved in Simcenter Femap, Teamcenter, gPROMS Web Applications Publisher, and Ruggedcom Rox. A high-severity flaw in KACO Blueplanet inverters can lead to information disclosure, and users have been informed about a control panel escape issue affecting Simatic HMI Unified Comfort. Schneider Electric has published four new advisories. Three of them address high-severity vulnerabilities in EcoStruxure Panel Server (sensitive information exposure), EasyLogic T150 and Saitel DP RTU (unauthorized file access), and EasyLogic, PowerLogic, Easergy, and EcoStruxure products (session hijacking). A medium-severity information disclosure flaw has been patched in Ecostruxure Machine Expert HVAC. CISA has published advisories for several ABB product vulnerabilities over the past two weeks. On Patch Tuesday, it also released advisories for security holes found in products from Subnet Solutions, Fuji Electric, Maxhub, and Johnson Controls. Germany’s CERT@VDE published a new advisory to describe a medium-severity DoS flaw in Codesys Modbus. Related: Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants Related: EnOcean SmartServer Flaws Expose Buildings to Remote Hacking Related: Hundreds of Internet-Facing VNC Servers Expose ICS/OT
securityweek.comMay 13, 2026extracted
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business Warehouse (CVE-2026-27681, CVSS score: 9.9) that could result in the execution of arbitrary database commands. "The vulnerable ABAP program allows a low-privileged user to upload a file with arbitrary SQL statements that will then be executed," Onapsis said in an advisory. In a potential attack scenario, a bad actor could abuse the affected upload-related functionality to run malicious SQL against BW/BPC data stores, extract sensitive data, and delete or corrupt database content. "Manipulated planning figures, broken reports, or deleted consolidation data can undermine close processes, executive reporting, and operational planning," Pathlock said. "In the wrong hands, this issue also creates a credible path to both stealthy data theft and overt business disruption." Another security vulnerability that deserves a mention is a critical-severity remote code execution in Adobe Acrobat Reader (CVE-2026-34621, CVSS score: 8.6) that has come under active exploitation in the wild. That said, there are many unknowns at this stage. It is not clear how many people have been affected by the hacking campaign. Nor is there any information about who is behind the activity, who is being targeted, and what their motives could be. Also patched by Adobe are five critical flaws in ColdFusion versions 2025 and 2023 that, if successfully exploited, could lead to arbitrary code execution, application denial-of-service, arbitrary file system read, and security feature bypass. The vulnerabilities are listed below - CVE-2026-34619 (CVSS score: 7.7) - A path traversal vulnerability leading to security feature bypass CVE-2026-27304 (CVSS score: 9.3) - An improper input validation vulnerability leading to arbitrary code execution CVE-2026-27305 (CVSS score: 8.6) - A path traversal vulnerability leading to arbitrary file system read CVE-2026-27282 (CVSS score: 7.5) - An improper input validation vulnerability leading to security feature bypass CVE-2026-27306 (CVSS score: 8.4) - An improper input validation vulnerability leading to arbitrary code execution Fixes have also been released for two critical FortiSandbox vulnerabilities that could result in authentication bypass and code execution - CVE-2026-39813 (CVSS score: 9.1) - A path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. (Fixed in versions 4.4.9 and 5.0.6) CVE-2026-39808 (CVSS score: 9.1) - An operating system command injection vulnerability in FortiSandbox that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. (Fixed in version 4.4.9) The development comes as Microsoft addressed a staggering 169 security defects, including a spoofing vulnerability impacting Microsoft SharePoint Server (CVE-2026-32201, CVSS score: 6.5) that could allow an attacker to view sensitive information. The company said it's being actively exploited, although there are no insights into the in-the-wild exploitation associated with the bug. "SharePoint services, especially those used as internal document stores, can be a treasure trove for threat actors looking to steal data, especially data that may be leveraged to force ransom payments using double extortion techniques by threatening to release the stolen data if payment is not made," Kev Breen, senior director of threat research at Immersive, said. "A secondary concern is that threat actors with access to SharePoint services could deploy weaponised documents or replace legitimate documents with infected versions that would allow them to spread to other hosts or victims moving laterally across the organization." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Apple ASUS AVEVA Broadcom (including VMware) Canon Cisco Citrix CODESYS D-Link Dassault Systèmes Dell Devolutions dormakaba Drupal Elastic F5 Fortinet Foxit Software FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) Huawei IBM Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox, Firefox ESR, and Thunderbird NETGEAR Node.js NVIDIA ownCloud Palo Alto Networks Phoenix Contact Progress Software QNAP Qualcomm Rockwell Automation Ruckus Wireless Samsung Schneider Electric Siemens SonicWall Splunk Spring Framework Supermicro Synology TP-Link WatchGuard, and Xiaomi
thehackernews.comApr 15, 2026extracted
ICS Patch Tuesday: 8 Industrial Giants Publish New Security Advisories
Industrial giants Siemens, Schneider Electric, Aveva, Rockwell Automation, ABB, Phoenix Contact, Mitsubishi Electric, and Moxa have published new ICS security advisories since the previous Patch Tuesday. Siemens has published nine new advisories since the previous Patch Tuesday. Vulnerabilities with a ‘critical’ severity rating are mentioned only in one advisory covering older Wi-Fi vulnerabilities affecting Scalance W-700 devices. Siemens has addressed high-severity vulnerabilities in Sinec NMS (authentication/authorization bypass), Ruggedcom Crossbow (privilege escalation, code execution, DoS), and Industrial Edge Management (authorization bypass). Medium-severity issues have been resolved in TPM and Analytics Toolkit. The company also announced that it’s participating in the CVE Program’s new Supplier Authorized Data Publisher (SADP) project, which enables vendors such as Siemens to add information to vulnerability entries. Cisco, Microsoft, HeroDevs, Oracle, and Red Hat also took part in the SADP pilot. Schneider Electric has published three new advisories. One of them describes the impact of the BlastRadius vulnerability disclosed in 2024 on the company’s Modicon Networking Managed Switch. The other two advisories cover medium-severity vulnerabilities in the PowerChute Serial Shutdown UPS management software and Easergy MiCOM Px40 protection relays. Aveva released an advisory to inform customers about a critical missing authorization and privilege escalation vulnerability in Pipeline Simulation. Since the last Patch Tuesday, Rockwell Automation published an important notice urging customers to disconnect PLCs from the internet after becoming aware of potential threat actor activity. The alert is likely related to the attacks conducted by Iran-linked threat groups against critical infrastructure organizations via PLC hacking. ABB has issued four advisories since the previous Patch Tuesday. Three of them cover third-party component vulnerabilities in Ability Camera Connect, Ability Symphony, and System 800xA products. The last advisory describes a DoS vulnerability in the System 800xA and Symphony Plus IEC 61850 communication stack. Phoenix Contact has one new advisory that informs customers about multiple flaws in FL Switch products. Mitsubishi Electric released two new advisories: one for a DoS vulnerability introduced by Realtek chips in home appliances; and one for multiple information disclosure, tampering, and DoS flaws in Genesis64, Iconics Suite, MobileHMI, Hyper Historian, AnalytiX, and MC Works64 products. Moxa has a new advisory covering an MxGeneralIo security hole that can lead to DoS or privilege escalation. Since the previous Patch Tuesday, CISA has published advisories for vulnerabilities in GPL Odorizers, Contemporary Controls, Mitsubishi Electric, Hitachi Energy, Yokogawa, PX4, Anritsu, PTC, OpenCode Systems, Wago, Pharos, Grassroots, Automated Logic, IGL-Technologies, CTEK, Codesys, and Inductive Automation products. Germany’s CERT@VDE has released advisories for Codesys, MB Connect Line, Helmholz, Wago, Phoenix Contact, Baade M2M-Products, and Endress+Hauser products.
securityweek.comApr 15, 2026extracted
Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices
SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 (CVSS score: 9.8) - A code injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) CVE-2026-27685 (CVSS score: 9.1) - An insecure deserialization vulnerability in SAP NetWeaver Enterprise Portal Administration "The application uses an outdated artifact of Apache Log4j 1.2.17 that is vulnerable to CVE-2019-17571," SAP security company Onapsis said. "It allows an unprivileged attacker to execute arbitrary code remotely on the server, causing high impact on confidentiality, integrity, and availability of the application." CVE-2026-27685, on the other hand, stems from missing or insufficient validation during the deserialization of uploaded content, which could allow an attacker to upload untrusted or malicious content. "Only the fact that an attacker requires high privileges for a successful exploit prevents the vulnerability from being tagged with a CVSS score of 10," Onapsis added. The disclosure comes as Microsoft shipped patches for 84 vulnerabilities across products, including dozens of privilege escalation and remote code execution flaws. On Tuesday, Adobe also announced patches for 80 vulnerabilities, four of which are critical flaws impacting Adobe Commerce and Magento Open Source that could result in privilege escalation and security feature bypass. Separately, it fixed five critical vulnerabilities in Adobe Illustrator that could pave the way for arbitrary code execution. Elsewhere, Hewlett Packard Enterprise put out fixes for five shortcomings in Aruba Networking AOS-CX. The most severe of the flaws is CVE-2026-23813 (CVSS score: 9.8), an authentication bypass affecting the management interface. "A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls," HPE said. "In some cases, this could enable resetting the admin password." "Exploitation of this Aruba vulnerability potentially gives attackers full control of AOS-CX network devices and the ability to compromise an entire system undetected," Ross Filipek, CISO at Corsica Technologies, said in a statement. "A successful compromise could lead to the disruption of network communications or the erosion of the integrity of key business services. This flaw is a reminder that vulnerabilities in network devices are becoming more common in today's hyper-connected world. When attackers gain privileged access to these devices, it puts organizations at significant risk." Software Patches from Other Vendors Security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD Arm Atlassian Bosch Broadcom (including VMware) Canon Cisco Commvault Dassault Systèmes Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software GitLab Google Android and Pixel Google Chrome Google Cloud Google Pixel Watch Google Wear OS Grafana Hitachi Energy Honeywell HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Jenkins Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric Moxa Mozilla Firefox, Firefox ESR, and Thunderbird n8n NVIDIA Palo Alto Networks QNAP Qualcomm Ricoh Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Synology TP-Link Trend Micro WatchGuard Western Digital Zoom, and Zyxel
thehackernews.comMar 11, 2026extracted
Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms
It's Patch Tuesday, which means a number of software vendors have released patches for various security vulnerabilities impacting their products and services. Microsoft issued fixes for 59 flaws, including six actively exploited zero-days in various Windows components that could be abused to bypass security features, escalate privileges, and trigger a denial-of-service (DoS) condition. Elsewhere, Adobe released updates for Audition, After Effects, InDesign Desktop, Substance 3D, Bridge, Lightroom Classic, and DNG SDK. The company said it's not aware of in-the-wild exploitation of any of the shortcomings. SAP shipped fixes for two critical-severity vulnerabilities, including a code injection bug in SAP CRM and SAP S/4HANA (CVE-2026-0488, CVSS score: 9.9) that an authenticated attacker could use to run an arbitrary SQL statement and lead to a full database compromise. The second critical vulnerability is a case of a missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVE-2026-0509, CVSS score: 9.6) that could permit an authenticated, low-privileged user to perform certain background Remote Function Calls without the required S_RFC authorization. "To patch the vulnerability, customers must implement a kernel update and set a profile parameter," Onapsis said. "Adjustments in user roles and UCON settings might be required to not interrupt business processes." Rounding off the list, Intel and Google said they teamed up to examine the security of Intel Trust Domain Extensions (TDX) 1.5, uncovering five vulnerabilities in the module (CVE-2025-32007, CVE-2025-27940, CVE-2025-30513, CVE-2025-27572, and CVE-2025-32467), and nearly three dozen weaknesses, bugs, and improvement suggestions. "Intel TDX 1.5 introduces new features and functionality that bring confidential computing significantly closer to feature parity with traditional virtualization solutions," Google said. "At the same time, these features have increased the complexity of a highly privileged software component in the TCB [Trusted Computing Base]." Software Patches from Other Vendors Security updates have also been released by other vendors in recent weeks to rectify several vulnerabilities, including — ABB Amazon Web Services AMD AMI Apple ASUS AutomationDirect AVEVA Broadcom (including VMware) Canon Check Point Cisco Citrix Commvault ConnectWise D-Link Dassault Systèmes Dell Devolutions dormakaba Drupal F5 Fortinet Foxit Software FUJIFILM Fujitsu Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision Hitachi Energy HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Intel Ivanti Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Thunderbird n8n NVIDIA Phoenix Contact QNAP Qualcomm Ricoh Rockwell Automation Samsung Schneider Electric ServiceNow Siemens SolarWinds Splunk Spring Framework Supermicro Synology TP-Link WatchGuard Zoho ManageEngine Zoom, and Zyxel
thehackernews.comFeb 11, 2026extracted
Black Basta boss makes it onto Interpol's 'Red Notice' list
The identity of the Black Basta ransomware gang leader has been confirmed by law enforcement in Ukraine and Germany, and the individual has been added to the wanted list of Europol and Interpol. Germany's Federal Criminal Police Office (BKA) identified Oleg Evgenievich Nefedov, a 35-year-old Russian national, as the leader of the Black Basta ransomware gang. The Ukrainian police in collaboration with German authorities also identified two additional individuals allegedly working for the ransomware operation and conducted raids at two locations in the Ivano-Frankivsk and Lviv regions. The police say that the two suspects specialized in gaining initial access to target networks and prepared the ground for the subsequent phases of the ransomware attack. "According to investigators, the suspects specialized in technically breaching protected systems and were involved in preparing ransomware-based cyberattacks," Ukraine's cyberpolice said. "The attackers performed the functions of so-called hash crackers - individuals who specialize in extracting passwords to accounts from information systems using specialized software," the press release explains. After getting access credentials belonging to company employees, the suspects breached internal corporate systems and increased the privileges of the stolen accounts. During the raids at the locations of the two suspected members of the Russian-affiliated hacker group, the Ukrainian police seized digital storage devices and cryptocurrency assets. The Black Basta boss Nefedov, known online under the aliases: tramp, tr, gg, kurva, AA, Washingt0n, and S.Jimmi, has been linked to the cybercriminal operation since last February, after someone leaked more than 200,000 chat messages between Black Basta members. While Nefedov is believed to be the founder and leader of Black Basta, there is also credible evidence linking him to Conti, a now-defunct ransomware syndicate that emerged in 2020 as a successor to Ryuk. After Conti shut down, it split into smaller cells that infiltrated other ransomware operations or took over existing ones. One of the new operations was Black Basta, considered a rebranding of the old Conti. Security researchers at Trellix analyzed the leaked texts and found conversations between GG and Chuck about "a $10 million reward for information on ‘tr’ (possibly ‘-amp’), potentially referring to the US bounty for five key members of the Conti gang, including the hacker Tramp." "In the leaked chat, GG was indeed identified as Tramp (Conti leader) by ‘bio’, (also known as ‘pumba’, another Conti member)," Trellix researchers said. It should be mentioned that in February 2022, after Russia invaded Ukraine, a researcher leaked internal chats from the Conti operation, where Tramp was referenced as the leader. However, authorities have officially confirmed Nefedov as the leader of the Black Basta ransomware gang and have added him to Europol's "Most Wanted" and Interpol's "Red Notice" lists. The Black Basta ransomware-as-a-service (RaaS) operation emerged in April 2022 and is believed to be responsible for at least 600 ransomware incidents, data theft, and extortion targeting large organizations worldwide. Notable victims include German defense contractor Rheinmetall, Hyundai's European division, BT Group (formerly British Telecom), U.S. healthcare giant Ascension, government contractor ABB, the American Dental Association, U.K. tech outsourcing firm Capita, the Toronto Public Library, and Yellow Pages Canada. BleepingComputer has contacted the Ukrainian police asking for more information about the operation, but a comment wasn't immediately available. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comJan 16, 2026extracted
Police raid homes of alleged Black Basta hackers, hunt suspected Russian ringleader
Police raid homes of alleged Black Basta hackers, hunt suspected Russian ringleader Ukrainian and German law enforcement authorities have identified two Ukrainians suspected of working for the Russia-linked ransomware group Black Basta and have placed the group’s alleged leader, a Russian national, on an international wanted list, officials said on Thursday. Black Basta has been active since at least early 2022 and is believed to be responsible for extorting hundreds of companies, hospitals and public institutions worldwide — including Swiss industrial giant ABB and U.S. healthcare provider Ascension — causing hundreds of millions of dollars in estimated damages. The two Black Basta suspects, who were operating from western Ukraine, allegedly specialized in breaching protected systems and preparing ransomware attacks by extracting login credentials from compromised networks. Police described them as so-called “hash crackers,” responsible for recovering passwords from stolen data using specialized software. The stolen credentials were later used to gain unauthorized access to internal corporate systems, escalate privileges within networks, steal sensitive data and deploy ransomware designed to encrypt systems and extort cryptocurrency payments from victims. Digital storage devices and cryptocurrency assets were seized during searches at the suspects’ homes in Ukraine’s Ivano-Frankivsk and Lviv regions. Ukrainian prosecutors said analysis of the seized material is ongoing. Alleged ringleader Germany’s Federal Criminal Police Office (BKA) identified the suspected leader of the group as Oleg Nefedov, a 36-year-old Russian national, who is wanted on suspicion of forming a criminal organization abroad, large-scale extortion and related cyber offenses. As the group’s alleged ringleader, Nefedov is suspected of selecting targets, recruiting members, assigning tasks, negotiating ransom payments and distributing proceeds obtained through extortion. Ransoms were typically demanded in cryptocurrency. Authorities said he operated under multiple online aliases — including tramp, tr, gg, kurva, AA, Washingt0n, and S.Jimmi — and may also have had ties to another notorious ransomware group, Conti. German police said Nefedov is believed to be in Russia, although his exact whereabouts are unknown. He has been placed on an international wanted list through Interpol. Last February, internal chat logs belonging to Black Basta were leaked, revealing the group’s internal structure and day-to-day operations. The leaked material reportedly contained identifying details about individuals involved in the scheme. Researchers previously said that several members of the Black Basta crew previously belonged to a criminal network that operated the Conti and Ryuk ransomware strains, as well as the TrickBot banking trojan. More than a dozen individuals linked to those operations have since been publicly identified and sanctioned by Western authorities. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
therecord.mediaJan 16, 2026extracted
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Aveva, Phoenix Contact
Industrial giants Siemens, Schneider Electric, Phoenix Contact, and Aveva have published a dozen Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS/OT products. Siemens has released five new advisories. Two of them describe the same critical authorization bypass flaw in Industrial Edge Devices that can be leveraged by an unauthenticated, remote attacker to bypass authentication and impersonate a user. One advisory covers Industrial Edge Devices, while the other is for the Industrial Edge Device Kit. The remaining advisories inform customers about the availability of fixes for high-severity vulnerabilities in Ruggedcom, ET 200SP, and TeleControl Server Basic products. Schneider Electric has published four new advisories. One of them describes a high-severity issue that can be leveraged for privilege escalation in EcoStruxure Process products. Another advisory describes one medium- and one high-severity flaw in EcoStruxure Power Build Rapsody. They can be exploited for arbitrary code execution using specially crafted files. The remaining advisories describe vulnerabilities in third-party components used by Schneider Electric products, specifically Zigbee and Redis. Phoenix Contact has released an advisory to inform customers about a high-severity command injection issue that can be exploited by an attacker against TC Router and Cloud Client industrial routers. Exploitation requires the attacker to have elevated privileges on the targeted system, or they need trick the victim into uploading a malicious payload. Germany’s VDE CERT has also published a version of Phoenix Contact’s advisory. Aveva has published an advisory describing seven types of vulnerabilities in Process Optimization (formerly ROMeo). The security holes, rated high and critical severity, can be exploited for remote code execution, privilege escalation, and to obtain sensitive data. Honeywell has released security advisories for its Pro-Watch and Maxpro building security and video management products. The advisories mostly focus on Windows patches released by Microsoft. The cybersecurity agency CISA has published ICS advisories for Rockwell Automation vulnerabilities disclosed by the vendor in December 2025, as well as for three flaws found in the YoSmart YoLink Smart Hub. A few days before Patch Tuesday, ABB published an advisory to inform customers about three flaws that can lead to authentication bypass and DoS in its WebPro SNMP Card PowerValue product. Related: ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Rockwell, Schneider
securityweek.comJan 15, 2026extracted
Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
Microsoft on Tuesday rolled out its first security update for 2026, addressing 114 security flaws, including one vulnerability that it said has been actively exploited in the wild. Of the 114 flaws, eight are rated Critical, and 106 are rated Important in severity. As many as 58 vulnerabilities have been classified as privilege escalation, followed by 22 information disclosure, 21 remote code execution, and five spoofing flaws. According to data collected by Fortra, the update marks the third-largest January Patch Tuesday after January 2025 and January 2022. These patches are in addition to two security flaws that Microsoft has addressed in its Edge browser since the release of the December 2025 Patch Tuesday update, including a spoofing flaw in its Android app (CVE-2025-65046, 3.1) and a case of insufficient policy enforcement in Chromium's WebView tag (CVE-2026-0628, CVSS score: 8.8). The vulnerability that has come under in-the-wild exploitation is CVE-2026-20805 (CVSS score: 5.5), an information disclosure flaw impacting Desktop Window Manager. The Microsoft Threat Intelligence Center (MTIC) and Microsoft Security Response Center (MSRC) have been credited with identifying and reporting the flaw. "Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager (DWM) allows an authorized attacker to disclose information locally," Microsoft said in an advisory. "The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a section address from a remote ALPC port, which is user-mode memory." There are currently no details on how the vulnerability is being exploited, the scale of such efforts, and who may be behind the activity. "DWM is responsible for drawing everything on the display of a Windows system, which means it offers an enticing combination of privileged access and universal availability, since just about any process might need to display something," Adam Barnett, lead software engineer at Rapid7, said in a statement. "In this case, exploitation leads to improper disclosure of an ALPC port section address, which is a section of user-mode memory where Windows components coordinate various actions between themselves." Microsoft previously addressed an actively exploited zero-day flaw in DWM in May 2024 (CVE-2024-30051, CVSS score: 7.8), which was described as a privilege escalation flaw that was abused by multiple threat actors, in connection with the distribution of QakBot and other malware families. Satnam Narang, senior staff research engineer at Tenable, called DWM a "frequent flyer" on Patch Tuesday, with 20 CVEs patched in the library since 2022. Jack Bicer, director of vulnerability research at Action1, said the vulnerability can be exploited by a locally authenticated attacker to disclose information, defeat address space layout randomization (ASLR), and other defenses. "Vulnerabilities of this nature are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits," Kev Breen, senior director of cyber threat research at Immersive, told The Hacker News. "By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the latest fixes by February 3, 2026. Another vulnerability of note concerns a security feature bypass impacting Secure Boot Certificate Expiration (CVE-2026-21265, CVSS score: 6.4) that could allow an attacker to undermine a crucial security mechanism that ensures that firmware modules come from a trusted source and prevent malware from being run during the boot process. In November 2025, Microsoft announced that it will be expiring three Windows Secure Boot certificates issued in 2011, effective June 2026, urging customers to update to their 2023 counterparts - Microsoft Corporation KEK CA 2011 (June 2026) - Microsoft Corporation KEK 2K CA 2023 (for signing updates to DB and DBX) Microsoft Windows Production PCA 2011 (October 2026) - Windows UEFI CA 2023 (for signing the Windows boot loader) Microsoft UEFI CA 2011 (June 2026) - Microsoft UEFI CA 2023 (for signing third-party boot loaders) and Microsoft Option ROM UEFI CA 2023 (for signing third-party option ROMs) "Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time," Microsoft said. "To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance." The Windows maker also pointed out that the latest update removes Agere Soft Modem drivers "agrsm64.sys" and "agrsm.sys" that were shipped natively with the operating system. The third-party drivers are susceptible to a two-year-old local privilege escalation flaw (CVE-2023-31096, CVSS score: 7.8) that could allow an attacker to gain SYSTEM permissions. In October 2025, Microsoft took steps to remove another Agere Modem driver called "ltmdm64.sys" following in-the-wild exploitation of a privilege escalation vulnerability (CVE-2025-24990, CVSS score: 7.8) that could permit an attacker to gain administrative privileges. Also high on the priority list should be CVE-2026-20876 (CVSS score: 6.7), a critical-rated privilege escalation flaw in Windows Virtualization-Based Security (VBS) Enclave, enabling an attacker to obtain Virtual Trust Level 2 (VTL2) privileges, and leverage it to subvert security controls, establish deep persistence, and evade detection. "It breaks the security boundary designed to protect Windows itself, allowing attackers to climb into one of the most trusted execution layers of the system," Mike Walters, president and co-founder of Action1, said. "Although exploitation requires high privileges, the impact is severe because it compromises virtualization-based security itself. Attackers who already have a foothold could use this flaw to defeat advanced defenses, making prompt patching essential to maintain trust in Windows security boundaries." Software Patches from Other Vendors In addition to Microsoft, security updates have also been released by other vendors since the start of the month to rectify several vulnerabilities, including — ABB Adobe Amazon Web Services AMD Arm ASUS Broadcom (including VMware) Cisco ConnectWise Dassault Systèmes D-Link Dell Devolutions Drupal Elastic F5 Fortinet Fortra Foxit Software FUJIFILM Gigabyte GitLab Google Android and Pixel Google Chrome Google Cloud Grafana Hikvision HP HP Enterprise (including Aruba Networking and Juniper Networks) IBM Imagination Technologies Lenovo Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu MediaTek Mitel Mitsubishi Electric MongoDB Moxa Mozilla Firefox and Firefox ESR n8n NETGEAR Node.js NVIDIA ownCloud QNAP Qualcomm Ricoh Samsung SAP Schneider Electric ServiceNow Siemens SolarWinds SonicWall Sophos Spring Framework Synology TP-Link Trend Micro, and Veeam
thehackernews.comJan 14, 2026extracted
ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Rockwell, Aveva, Schneider
Industrial giants Siemens, Schneider Electric, Rockwell Automation, and Aveva have released Patch Tuesday advisories informing customers about vulnerabilities in their ICS/OT products. Siemens published six new advisories. One of them covers two vulnerabilities in the Comos plant engineering software, including a critical code execution flaw, and a high-severity security bypass issue. Vulnerabilities have also been addressed in Siemens Solid Edge (remote MitM, code execution), Altair Grid Engine (code execution), Logo! 8 BM (code execution, DoS, settings tampering), and Sicam P850 (CSRF) products. Rockwell Automation published five new advisories on November 11, each covering high-severity vulnerabilities found in various products. The company informed customers of its Verve Asset Manager OT security platform that the product is affected by a high-severity access control issue that allows unauthorized read-only users to tamper with other user accounts via an API. In the Studio 5000 integrated design environment for Logix 5000 controllers, Rockwell fixed an SSRF flaw exposing NTLM hashes, as well as a local code execution bug. MFA bypass and persistent XSS vulnerabilities have been patched in FactoryTalk DataMosaix Private Cloud. In addition, flaws introduced by the use of third-party components have been fixed in SIS Workstation (code execution) and FactoryTalk Policy Manager (DoS). Aveva published two new advisories on Tuesday. One of them describes a high-severity persistent XSS flaw that can be exploited for privilege escalation. The second advisory covers an Aveva Edge vulnerability that allows an attacker with read access to project and cache files to obtain user passwords by brute-forcing weak hashes. This vulnerability also impacts Schneider Electric’s EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio products. Schneider published two new advisories this Patch Tuesday and one of them covers the impact of this flaw. Schneider’s second advisory describes high-severity path traversal, authentication brute-forcing, and privilege escalation issues in the PowerChute Serial Shutdown UPS management software. Moxa, ABB, Honeywell, and Mitsubishi Electric did not publish any advisories on Patch Tuesday, but they all informed customers about fixed vulnerabilities in the preceding days. Germany’s VDE@CERT also published two advisories in recent days. Related: ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories
securityweek.comNov 12, 2025extracted
Cybersecurity jobs available right now: October 21, 2025
Cybersecurity jobs available right now: October 21, 2025 CISO Open-Xchange | Germany | Remote – No longer accepting applications As a CISO, you will lead the development and implementation of security strategies and requirements across the OX Group. You will advise management on information security matters, provide transparent reporting, and drive continuous improvement of the organization’s security management system. You will oversee risk assessments, monitor emerging threats, and ensure secure product development, system architecture, and cloud operations. CISO Princeton University | USA | On-site – No longer accepting applications As a CISO, you will guide the CIO and senior leadership on information security strategy, balancing Princeton’s academic mission with risk and compliance needs. You will lead the development and implementation of security and data governance policies in collaboration with University leadership and IT teams. Cyber Infrastructure Specialist GDIT | USA | Remote – No longer accepting applications As a Cyber Infrastructure Specialist, you will design, deploy, and maintain enterprise server and virtualization environments, including VMware vSphere, vSAN, and NSX. Build and configure virtual machines, clusters, storage, and networking for high availability and scalability. Ensure compliance with NIST 800-53, RMF, FISMA, or other federal cybersecurity requirements as applicable. Get weekly updates on new cybersecurity job openings. Subscribe here! Cyber Security Analyst Portakabin | United Kingdom | On-site – No longer accepting applications As a Cyber Security Analyst, you will monitor and analyze security systems, alerts, and daily reports related to phishing, endpoint compliance, and account activity. You will conduct regular security audits, complete customer questionnaires, and investigate and document incidents or breaches. You will also maintain dashboards and metrics, track security trends, and update policies and ISMS documentation to ensure ongoing compliance and improvement. Cyber Security Consultant SOPHTIX | Israel | Hybrid – No longer accepting applications As a Cyber Security Consultant, you will be responsible for conducting security assessments, identifying and analyzing vulnerabilities, creating security strategies, providing recommendations for improvement, and implementing security measures. Additionally, the consultant will stay updated on the latest security trends and technologies and provide expert advice to clients. Cyber Security Engineer RONIN Dynamics | Australia | Remote – No longer accepting applications As a Cyber Security Engineer, you will lead the deployment, configuration, and optimisation of the SentinelOne Singularity XDR platform across enterprise and government environments. Integrate SentinelOne with SIEM/SOAR systems and other security platforms to enhance visibility and automation. Perform threat hunting, incident analysis, and remediation through the console. Cyber Security Engineer Protergo | Indonesia | On-site – No longer accepting applications As a Cyber Security Engineer, you will perform vulnerability assessments, penetration testing, and red teaming in a consulting environment. You will conduct security evaluations across cloud, on-premises, and hybrid infrastructures to identify and mitigate risks. Your work will help strengthen clients’ security posture through comprehensive assessments and actionable recommendations. Cyber Threat Investigator ColorTokens | India | On-site – No longer accepting applications As a Cyber Threat Investigator, you will conduct proactive threat hunting across endpoints, network, cloud, and identity systems using telemetry and behavioral indicators. Develop hunting hypotheses based on current threat landscape, TTPs (MITRE ATT&CK), and internal observations. Utilize threat intelligence to identify new indicators of compromise (IOCs) and behavioral patterns. Cybersecurity Consultant Henkel | Germany | Hybrid – No longer accepting applications As a Cybersecurity Consultant, you will conduct comprehensive security assessments of IT systems, projects and organizations. Collaborate with cross-functional teams to integrate security measures into business processes, IT organizations and IT systems. Develop and implement information security and cybersecurity policies, procedures, and controls. Director of Security THE ICONIC | Australia | Hybrid – View job details As a Director of Security, you will define, own and execute the company’s security strategy and roadmap, aligned with GFG’s security strategy and overall business objectives. Oversee and ensure compliance with relevant security standards and regulations. Conduct risk assessments and vulnerability management to reduce risk exposure through timely identification and mitigation. Head of Cyber Security RSPB | United Kingdom | Remote – No longer accepting applications As a Head of Cyber Security, you will lead the development, implementation, and continuous improvement of the RSPB’s cyber security strategy. Act as the senior accountable executive for cyber risk, compliance, and incident response. Provide expert advice to the CDTO, trustees, and executive board on cyber threats, risks, and mitigation strategies. Maintain oversight of cyber KPIs, threat intelligence, and incident response protocols. Ensure compliance with relevant regulatory frameworks. Head of Information Security Bluedrop Medical | Ireland | Hybrid – No longer accepting applications As a Head of Information Security, you will develop, lead, and continuously improve Bluedrop’ s information security program. Define and enforce policies and procedures aligned with ISO 27001, NIST CSF, HIPAA standards. Oversee risk assessments, vulnerability management, incident response, and third-party risk processes. Manage and prepare for external audits and certifications (e.g., ISO 27001, FedRAMP readiness assessments, HIPAA audits). Information Security Analyst Verdantas | India | On-site – No longer accepting applications As an Information Security Analyst, you will perform vulnerability scans and assessments, prioritizing and tracking remediation efforts. Manage and configure security tools, including EDR/XDR, antivirus, and email security gateways. Implement and manage identity and access management (IAM) policies and practices. Assist in the development and enforcement of security policies, standards, and procedures. Information Security GRC Manager Airties | France | Hybrid – No longer accepting applications As an Information Security GRC Manager, you will develop and maintain policies, procedures, and documentation related to information security governance, risk management, and compliance. Manage and develop information security initiatives, ensuring alignment with organizational goals and industry standards. Conduct internal security audits to assess the effectiveness of security controls and identify areas for improvement. Information Security Risk Manager Pantheon | Canada | Remote – No longer accepting applications As an Information Security Risk Manager, you will define Pantheon’s risk management methodology—establishing the organization’s risk appetite, scoring criteria, and treatment approach to ensure a consistent and effective process. You will lead risk assessments across all assets, develop and document risk treatment plans, and create the Statement of Applicability for ISO 27001 compliance. You will also monitor, report, and maintain all risk-related documentation to keep Pantheon’s information security program resilient and audit-ready. IS Global Cyber Security Lead ABB Robotics ABB | Italy | On-site – No longer accepting applications As an IS Global Cyber Security Lead ABB Robotics, you will develop and maintain cybersecurity policies, standards, and procedures aligned with ISO 27001, GDPR, NIS 2, TISAX, and SOX. Conduct risk assessments, manage the enterprise risk register, and define mitigation strategies with key stakeholders. Monitor emerging threats and coordinate with Security Operations to ensure effective detection and response. IT Security Specialist Volkswagen Group | Italy | Hybrid – No longer accepting applications As an IT Security Specialist, you will Design, implement, and validate security controls for networks, servers, endpoints, cloud services, and applications. Support and guide infrastructure and development teams in adopting secure configurations and practices. Lead technical investigations during security incidents, including root-cause analysis and remediation. Perform vulnerability assessments, penetration testing coordination, and security hardening. Lead Threat Hunter (OT Cybersecurity) CPX | UAE | On-site – No longer accepting applications As a Lead Threat Hunter (OT Cybersecurity), you will detect, investigate, and respond to advanced threats across operational technology environments. You will enhance threat detection by integrating new tools, tuning SIEM use cases, performing vulnerability analysis, and conducting hands-on cybersecurity testing of critical systems. You will collaborate with stakeholders to identify root causes, recommend remediation, and continuously improve detection, response, and threat-hunting processes across multiple environments. Manager, Detection Engineering Datadog | France | On-site – No longer accepting applications As a Manager, Detection Engineering, you will research emerging attack and defense techniques in cloud environments and translate those insights into actionable security content. You will lead your team in designing and delivering high-quality security integrations across Datadog’s Logs, Cloud SIEM, Cloud Security, and Workflow products. You will also define and track key metrics to demonstrate the impact and value of your team’s work to senior leadership. Offensive Security Engineer, Red Team Operations Group Meta | USA | On-site – No longer accepting applications As an Offensive Security Engineer, Red Team Operations Group, you will design, scope, and execute Red Team operations targeting both traditional and bespoke environments across Meta, evading preventions, detections, and response. Incorporate Threat Intelligence research to track APT trends and recreate their Tactics, Techniques, and Procedures for operations and other offensive security testing. Penetration Test Team Lead Clear Gate | Israel | Remote – No longer accepting applications As a Penetration Test Team Lead, you will manage and mentor a team of testers, overseeing client engagements to ensure high-quality, on-time delivery. You will review and approve test reports, guide technical execution, and drive continuous improvement in tools, scripts, and methodologies. You will also contribute to internal knowledge sharing, training, and process enhancements to strengthen overall testing capabilities. Security Assessment Automation Specialist (VP) SMBC Group | Ireland | Hybrid – No longer accepting applications As a Security Assessment Automation Specialist (VP), you will design and implement enterprise-grade security assessment pipelines integrating SAST, DAST, IAST, and SCA tools into CI/CD workflows. Integrate security testing into IaC workflows (Terraform, CloudFormation), ensuring security by design in automated deployments. Establish frameworks for automated enforcement of security baselines and compliance requirements. Senior Security Engineer – Security Automation Samsara | Canada | Remote – No longer accepting applications As a Senior Security Engineer – Security Automation, you will design and implement automation integrations using tools like Tines, AWS Lambda, and related platforms. You will drive infrastructure-as-code adoption with Terraform, managing configurations across enterprise tools such as GitHub, CrowdStrike, Splunk, and MDM systems, and build custom providers where integrations don’t exist. You’ll collaborate with engineers across teams to deliver projects, maintain core security systems, and handle escalations from cross-functional partners. Senior Manager, Threat Intelligence & Detection Nordstrom | USA | Hybrid – No longer accepting applications As a Senior Manager, Threat Intelligence & Detection, you will develop and execute the strategic roadmap for threat intelligence, detection engineering, and threat hunting programs across multiple business units. Drive development of advanced behavior-based, anomaly detections, and AI/ML-powered detection systems aligned with MITRE ATT&CK and emerging threat actor TTPs. Specialist IT, Operations & Information Security Audit Commercial Bank International | UAE | On-site – No longer accepting applications As a Specialist IT, Operations & Information Security Audit, you will support the Head of Audit in developing annual plans and performing risk assessments across IT, operational, and information security domains. You will lead and execute audit assignments, evaluate internal controls, identify risks, document findings, and recommend corrective actions to enhance efficiency and compliance. You will also prepare clear audit reports, coordinate with management on remediation plans, and ensure timely follow-up and continuous improvement of audit processes. Systems Vulnerability Management Analyst Apex Systems | USA | Remote – No longer accepting applications As a Systems Vulnerability Management Analyst, you will Support remediation of system vulnerabilities identified by cybersecurity, including planning and execution of fixes. Manage and maintain Windows OS environments (2008–2025) and Linux systems (Libuntu/Ubuntu). Oversee upgrades, patching, and replacement of end-of-life operating systems.
helpnetsecurity.comOct 21, 2025extracted
ICS Patch Tuesday: Fixes Announced by Siemens, Schneider, Rockwell, ABB, Phoenix Contact
The October 2025 Patch Tuesday has brought advisories from several major ICS/OT vendors, including Siemens, Schneider Electric, Rockwell Automation, ABB, Phoenix Contact, and Moxa. Siemens has published six new advisories, including two that describe critical vulnerabilities. One of them is a critical flaw in TeleControl Server Basic, which can allow an unauthenticated, remote attacker to obtain user password hashes. The attacker can then log in and perform unauthorized operations. The second critical bug is an authentication issue impacting Simatic ET 200SP communication processors. An unauthenticated, remote attacker can exploit the vulnerability to access configuration data. Several high- and medium-severity issues have been found in Siemens SiPass, which allow an unauthenticated remote attacker to exploit user accounts, manipulate data, impersonate users, or execute arbitrary code on the server. In Solid Edge, Siemens patched four high-severity vulnerabilities that can lead to an application crash or arbitrary code execution if the attacker can convince the victim to open specially crafted files. All issues were reported to the industrial giant by researcher Michael Heinzl. The company has also informed customers that a Chrome vulnerability known to have been exploited in the wild impacts HyperLynx and Industrial Edge App Publisher products. In addition, customers have been told about an SQL injection flaw in Sinec NMS that allows an authenticated attacker to insert malicious data and escalate privileges. Schneider Electric has only published one new advisory. It describes a high-severity EcoStruxure OPC UA Server Expert product vulnerability that can be exploited to cause a DoS condition. Rockwell Automation has published seven new advisories. One advisory has an overall severity rating of ‘critical’. It addresses three flaws in the 1783-NATR configurable NAT router, including one that can be exploited to cause a DoS condition, take control of admin accounts, and modify NAT rules. The remaining advisories address high-severity issues. Two privilege escalation flaws allowing an attacker to gain access to files, processes and system resources have been resolved in FactoryTalk Linx. A couple of other advisories address FactoryTalk product vulnerabilities. One informs customers about patches for FactoryTalk View Machine Edition and PanelView Plus 7 flaws allowing attackers to delete files or gain unauthorized access to the product. The second advisory covers a DoS issue in FactoryTalk ViewPoint. Rockwell has also released patches for DoS vulnerabilities in the 1715 EtherNet/IP Communications Module, Compact GuardLogix 5370 controllers, and ArmorStart distributed motor controllers. The cybersecurity agency CISA has published its own advisory for the Rockwell 1715 EtherNet/IP vulnerabilities. Phoenix Contact this week released two new advisories. One describes several vulnerabilities in QUINT4 UPS devices that can allow an unauthenticated, remote attacker to conduct DoS attacks and gather login credentials. The second advisory describes a vulnerability in the firmware of CHARX SEC-3xxx charging controllers that can be exploited for command injection with root privileges. Germany’s CERT@VDE has picked up the Phoenix Contact advisories and in addition it has published an advisory for a Murrelektronik product issue that exposes sensitive information. ABB published only one advisory on Patch Tuesday, but released several others in recent days. The Patch Tuesday advisory covers three medium-severity B&R Automation Runtime SDM issues allowing session takeover, code execution, and the injection of formula data into a CSV file. The other recent advisories describe security holes in MConfig (cleartext password dumping), Automation Runtime (DoS), and EIBPORT (XSS). Moxa published two advisories this month, on October 9. The company announced patches for hardcoded SSH private key and encryption-related issues in TRC-2190 series products. Related: ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories Related: ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities
securityweek.comOct 15, 2025extracted
ICS Patch Tuesday: Rockwell Automation Leads With 8 Security Advisories
Several industrial control systems (ICS) giants have published new security advisories this Patch Tuesday, including Rockwell Automation, Siemens, Schneider Electric, and Phoenix Contact. Rockwell Automation published the highest number of new advisories this Patch Tuesday. The company released eight new advisories, all of them covering high-severity vulnerabilities found recently in the company’s products. Rockwell fixed a sensitive data exposure issue in FactoryTalk Analytics LogixAI, and DoS and code execution issues in ControlLogix controllers. It also addressed a remote code execution vulnerability in Stratix (Cisco) devices, a memory corruption in 1783-NATR, a SSRF issue in Automation ThinManager, a remote code execution flaw in FactoryTalk Optix, and a data exposure issue in FactoryTalk Activation Manager. Siemens has published seven new advisories. With a CVSS score of 9.3, one of the most serious issues impacts Simatic Virtualization as a Service and allows an attacker to access or alter sensitive data. Another vulnerability with a ‘critical’ severity rating impacts Siemens’ User Management Component (UMC) and it can be exploited for unauthenticated remote code execution or DoS attacks. Siemens also addressed high-severity issues in Simotion and Industrial Edge Management products. Advisories covering medium- and low-severity flaws have been published for Sinamics, Apogee PXC and Talon TC, and Sinec OS products. Schneider Electric published only two new advisories this Patch Tuesday. One of them covers two medium-severity OS command injection issues in Saitel DR & Saitel DP RTU products. The second advisory informs customers about an XSS flaw in Altivar products. Phoenix Contact has published two new advisories: one for two vulnerabilities in the Jq JSON processor used by FL Mguard, and one for a vulnerability introduced by the use of Wibu’s CodeMeter Runtime. Honeywell has published several advisories for building management products, including Maxpro and Pro-Watch NVR and VMS products. CISA has published nine new and five updated advisories. Of the new advisories, a vast majority cover the Rockwell Automation product vulnerabilities. One CISA advisory informs organizations about ABB product vulnerabilities. The vendor published its own advisory for the flaws, which impact its Aspect building management system, earlier this month. The issues were reported to ABB by researcher Gjoko Krstic, who in January claimed to have found over 1,000 vulnerabilities in ABB products. Germany’s CERT@VDE agency published seven new advisories this week, including for a critical Wago controller vulnerability that can be exploited without authentication for DoS attacks and to weaken credentials, resulting in default credentials being applied to the device. CERT@VDE’s advisories also cover two other Wago product vulnerabilities, two Bender Charge Controller issues, and the recently disclosed Phoenix Contact flaws. Related: ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities
securityweek.comSep 10, 2025extracted
ICS Patch Tuesday: Major Vendors Address Code Execution Vulnerabilities
August 2025 Patch Tuesday advisories have been published by several major companies offering industrial control system (ICS) and other operational technology (OT) solutions. Siemens has published 22 new advisories. One of them is for CVE-2025-40746, a critical Simatic RTLS Locating Manager issue that can be exploited by an authenticated attacker for code execution with System privileges. The company has also published advisories covering high-severity vulnerabilities in Comos (code execution), Siemens Engineering Platforms (code execution), Simcenter (crash or code execution), Sinumerik controllers (unauthorized remote access), Ruggedcom (authentication bypass with physical access), Simatic (code execution), Siprotect (DoS), and Opcenter Quality (unauthorized access). Siemens also addressed vulnerabilities introduced by the use of third-party components, including OpenSSL, Linux kernel, Wibu Systems, Nginx, Nozomi Networks, and SQLite. Medium- and low-severity issues have been resolved in Simotion Scout, Siprotec 5, Simatic RTLS Locating Manager, Ruggedcom ROX II, and Sicam Q products. As usual, Siemens has released patches for many of these vulnerabilities, but only mitigations or workarounds are available for some of the flaws. Schneider Electric has released five new advisories. One of them describes four high-severity vulnerabilities in EcoStruxure Power Monitoring Expert (PME), Power Operation (EPO), and Power SCADA Operation (PSO) products. Exploitation of the flaws can lead to arbitrary code execution or sensitive data exposure. In the Modicon M340 controller and its communication modules the industrial giant fixed a high-severity DoS vulnerability that can be triggered with specially crafted FTP commands, as well as a high-severity issue that can lead to sensitive information exposure or a DoS condition. In the Schneider Electric Software Update tool, the company patched a high-severity vulnerability that can allow an attacker to escalate privileges, corrupt files, obtain information, or cause a persistent DoS. Medium-severity issues that can lead to privilege escalation, DoS, or sensitive credential exposure have been patched in Saitel and EcoStruxure products. Honeywell has published six advisories focusing on building management products, including several advisories that inform customers about Windows patches for Maxpro and Pro-Watch NVR and VMS products. The company has also released advisories covering PW-series access controller patches and security enhancements. Aveva has published an advisory for two issues in its PI Integrator for Business Analytics. Two vulnerabilities have been patched: one arbitrary file upload issue that could lead to code execution, and a sensitive data exposure weakness. ABB told customers on Tuesday about several vulnerabilities affecting its Aspect, Nexus and Matrix products. Some of the flaws can be exploited without authentication for remote code execution, obtaining credentials, and to manipulate files and various components. Phoenix Contact has informed customers about a privilege escalation vulnerability in Device and Update Management. The company has described it as a misconfiguration that allows a low-privileged local user to execute arbitrary code with admin privileges. Germany’s CERT@VDE has also published a copy of the Phoenix Contact advisory. The US cybersecurity agency CISA has published three new advisories describing vulnerabilities in Santesoft Sante PACS Server, Johnson Controls iSTAR, and Ashlar-Vellum products. CISA has also distributed the Aveva advisory and one of the Schneider Electric advisories. A few days prior to Patch Tuesday, Rockwell Automation published an advisory informing customers about several high-severity code execution vulnerabilities affecting its Arena Simulation product. Also prior to Patch Tuesday, Mitsubishi Electric released an advisory describing an information tampering flaw in Genesis and MC Works64 products. Related: ICS Patch Tuesday: Vulnerabilities Addressed by Rockwell, ABB, Siemens, Schneider
securityweek.comAug 13, 2025extracted