Act today Critical Known exploited Patch available CVSS up to 9.8
ABB IPEC iSM Local Server has flaws in PHP and NTFS-3G
ABB PSIRTABBCVE-2026-109618, CVE-2026-109619, CVE-2026-40706
What happened. ABB reports public vulnerabilities in third-party components (PHP and NTFS-3G) in the IPEC iSM Local Server. An attacker could insert and run arbitrary code. ABB has had no reports of active exploitation. Highest CVSS score stated: 9.8.
Who is affected. Users of ABB IPEC iSM Local Server. The report does not list affected version numbers.
What to do. Check whether you run ABB IPEC iSM Local Server, then apply the fixes or mitigations in the ABB advisory.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: The iSM Local Server is a site-level server that supports local operations, so it sits at the supervisory and site operations levels (L2 and L3).
- Are you exposed?
Search your asset inventory for ABB IPEC iSM Local Server and compare its version against the ABB advisory.
- If you cannot fix it yet
- Restrict network access to the server to known engineering and operator hosts only.
- Block access to the server from the corporate network and the internet at the firewall.
- Disable or remove any unused services on the server until it is updated.
- Watch for
- Unexpected new processes or scripts started by the web server (PHP) on the iSM Local Server.
- Unusual connections to the server from hosts that do not normally manage it.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: ABB PSIRT (opens search.abb.com)