Daily briefing

Today's Industrial Cyber Brief

8 stories made the cut this morning: 4 critical, 3 high, 1 medium, plus 4 more under Also today.

CriticalKnown exploitedPatch available

CISA lists new Check Point flaw as exploited, plus an UnrealIRCd flaw

CISA Cybersecurity Advisories

What happened. CISA added CVE-2026-123039, a Check Point multiple-products permissions flaw, and CVE-2026-114713, an UnrealIRCd flaw, to its Known Exploited Vulnerabilities Catalog. It cites evidence of active exploitation for both.

Who is affected. Users of Check Point products and UnrealIRCd. Industrial sites using a Check Point gateway for remote access are exposed, because vendors and engineers often reach plant systems through it.

What to do. Check whether you run Check Point products or UnrealIRCd, then apply the vendor patch, starting with anything reachable from the internet.

CriticalKnown exploitedPatch available

Check Point releases emergency fixes for gateway flaw already exploited

BleepingComputer

What happened. BleepingComputer reports Check Point has released emergency hotfixes for a high-severity flaw. Attackers have exploited it since late October to gain root privileges and set up persistence on vulnerable devices.

Who is affected. Organisations running vulnerable Check Point gateways. Industrial sites using such gateways for remote access are exposed, because vendors and engineers often reach plant systems through them. The source names no versions.

What to do. Apply the Check Point emergency hotfixes to your gateways. Check them for signs of compromise, as exploitation began in late October.

CriticalPatch available

Fourteen new flaws found in Dixell refrigeration supervision system

CyberScoop

What happened. VulnCheck published 14 flaws in Dixell XWEB EVO, made by Copeland. Each would give an attacker administrative access. At least two are exploited in the wild. XWEB was among systems hit in the October attack on 700 French supermarkets.

Who is affected. Operators of Dixell and Copeland XWEB EVO supervision systems, including food retail refrigeration in the US and Europe.

What to do. Check whether you run Dixell or Copeland XWEB EVO supervision systems and restrict access to them, starting with any that are reachable from the internet.

CriticalCheck your exposure

Hackers cut Ukraine's power three times; US says China has prepared

Nacionale (via Google News)

What happened. Nacionale reports that hackers have switched off power in Ukraine three times. It also reports that US agencies say China has prepared to try the same.

Who is affected. Energy sector organisations. The source does not say which organisations are affected.

What to do. No action is named. Share with your SOC or OT security team so they can check for the same indicators.

HighMonitor

Iranian hackers widen attacks from oil tankers to shop refrigeration

صوت الإمارات (via Google News)

What happened. A report from Sawt al-Emarat, found via Google News, says Iranian hackers are expanding their cyberwarfare. Targets named range from oil tankers to store refrigerators.

Who is affected. The report names the oil and gas, transport and retail refrigeration sectors. It does not name products or organisations.

What to do. Review remote access to operational controllers at your site, and brief your team on this reported Iranian activity.

HighMonitor

Explainer: China-linked Volt Typhoon found inside US power and water utilities

Nacionale (via Google News)

What happened. Nacionale explains Volt Typhoon, a China-linked hacking group. It reports the group has been found inside US power and water utilities.

Who is affected. US energy and water utilities, according to the report. The source does not name individual organisations.

What to do. No action is named. Share with your SOC or OT security team so they can check for the same indicators.

HighMonitor

US role in Caracas blackout claimed by officials but unproven

Nacionale (via Google News)

What happened. Nacionale reports that officials say the US hacked Venezuela's power grid to black out Caracas. The report says this is unproven.

Who is affected. Energy sector. The source does not say which organisations are affected.

What to do. No action is named. If you run similar equipment, check whether the same technique would work against your site.

MediumAwareness

Consumer Counsel criticises Eversource response to spring cyber attack

Hartford Courant (via Google News)

What happened. The Hartford Courant reports Connecticut's Consumer Counsel faults how Eversource responded to a spring cyber attack. It wants further review as part of the utility's rate increase case.

Who is affected. Eversource, an energy utility. The source does not say which systems were affected.

What to do. Brief your leadership on this regulatory scrutiny and review how your own incident response would be judged.

Also today

Smaller items, below the bar for the stories above. Listed so the day is complete. How the bar works

HighPatch available

FortiOS SSL VPN flaw lets attacker intercept portal traffic

Fortinet PSIRT

What happened. Fortinet says improper certificate validation in FortiOS SSLVPN may let a remote, unauthenticated attacker run a man-in-the-middle attack between the SSLVPN web portal and the backend website. CVSS score 7.7. Revised 12 November 2026.

Who is affected. Users of Fortinet FortiOS SSLVPN. Industrial sites using it for remote access are exposed, because vendors and engineers often reach plant systems through such gateways.

What to do. Check whether you run FortiOS with SSLVPN web portal enabled, and apply the fix from the Fortinet advisory.

MediumPatch available

Johnson Controls EasyIO FW has a confirmed vulnerability

Canadian Centre for Cyber Security

What happened. The Canadian Centre for Cyber Security says Johnson Controls has confirmed a vulnerability in EasyIO FW, up to and including V3.0b25. It urges users to review the advisory links and apply updates.

Who is affected. Users of Johnson Controls EasyIO FW V3.0b25 and earlier, a building automation product.

What to do. Check whether you run EasyIO FW V3.0b25 or earlier, and apply the Johnson Controls update when available.

LowMonitor

AI finds 99 flaws in network software used in industrial devices

Industrial Cyber

What happened. Forescout Research's Vedere Labs used off-the-shelf AI models to examine 10 widely used TCP/IP stacks in 90 hours, against about nine months by earlier methods. It found 99 vulnerabilities, 66 of them previously unknown. The automated analysis cost about $935.

Who is affected. The source names no specific products. TCP/IP stacks are embedded in connected products across OT, IoT, medical devices and critical infrastructure.

What to do. Brief your team that AI is lowering the cost of finding flaws, and ask device vendors how they will report and patch networking-stack flaws.

LowAwareness

US Energy Department develops AI cybersecurity tools for energy infrastructure

Industrial Cyber

What happened. The US Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER) is developing AI-powered tools through its AI-FORTS programme. It works with National Laboratories and utilities. The programme has three pillars, the first being Secure From AI.

Who is affected. The programme targets the energy sector and wider critical infrastructure. The source names no affected products.

What to do. No action required.