Vendors and CVEs › Sectors › Energy and power
Energy and power: industrial cyber security news for the sector
36 stories in Industrial Cyber Brief name Energy and power, 2 on CISA’s list of known exploited flaws, from Sunday 18 October 2026 to Wednesday 11 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Critical Known exploited
Bender fixes two exploited Linux kernel flaws in EDGE500IP
Bender says two Linux kernel flaws (CVE-2025-39682 and CVE-2025-39964) affect the EDGE500IP. CISA lists both as known exploited.
High
Report says hackers are targeting European infrastructure systems
A CBS News headline reports that high-tech hackers are targeting infrastructure systems in Europe. The report gives no further detail on who is behind it, which systems or which organisations.
Medium
Report warns Chinese solar inverters raise blackout risk
A Chosun Ilbo headline reports that cyber blackout risks are growing as Chinese solar inverters dominate the market. The report gives no further detail, and describes no confirmed attack or named product.
Medium
Memory flaw in Schneider Electric switchboard design software
Schneider Electric reports a use-after-free flaw in EcoStruxure Power Build Rapsody, software for entering single line diagrams and listing switchboard parts. Local attackers could potentially run arbitrary code.
High
Handala hacktivist group threatens Israeli water and power sites
The Jerusalem Post reports that the hacktivist group Handala has threatened Israel's water and power sites. The report gives no detail on methods, targets or any attack.
Low
Interview profiles industrial security practitioner Mike Holcomb
Industrial Cyber's Hall of Fame interview features Mike Holcomb, an ICS/OT cybersecurity leader who founded UtilSec after leaving Fluor.
Low
Abbott Risk Consulting joins ISASecure certification programme
The International Society of Automation announced that Abbott Risk Consulting Ltd. has joined ISASecure, the certification programme for the ISA/IEC 62443 industrial cybersecurity standards.
High
Report claims UK cyber attack disrupted banks, power and water
A tabloid headline says a UK cyber attack caused banks, power and water to fail in its first 72 hours.
Medium
Australia's 2026 risk review names AI as growing threat to infrastructure
Australia's Critical Infrastructure Security Centre released its fourth annual risk review.
Low
Crytica Security signs US public sector distribution deal with Carahsoft
Crytica Security and Carahsoft announced a partnership.
Low
CISA launches November campaign on infrastructure resilience and recovery
CISA began its 2026 Critical Infrastructure Security and Resilience Month, themed 'Resolve to be Resilient'.
Critical
Subnet Solutions PowerSYSTEM Center has flaws allowing SQL commands and admin access
CISA lists two flaws in PowerSYSTEM Center: incorrect authorisation lets a low-privileged logged-in user reach administrator-only resources, and SQL injection could allow unauthorised database commands.
Low
OmniTrust launches GridAuth device identity platform for energy grids
OmniTrust announced GridAuth, a device identity and trust management platform for utilities and equipment makers using Wi-SUN field area networks, advanced metering infrastructure and connected-grid systems.
High
Hitachi Energy CoreTec flaws allow full device control by authenticated users
Hitachi Energy reported an operating system (OS) command injection flaw and a second flaw called Dirty Frag in CoreTec products.
Medium
Grid operator sets deadline for power producers to restore telemetry
NGC has set a deadline for independent power producers (IPPs) to restore their telemetry systems. It targets 95% data quality for supervisory control and data acquisition (SCADA) data.
Medium
ENGIE confirms attackers stole customer data from marketing platform
French energy provider ENGIE confirmed that attackers stole customer data after breaching a marketing platform used by business partners. The report does not state any effect on operations.
Medium
NERC CIP-003-9 vendor remote access rules create audit and recordkeeping burdens
Centrii says NERC CIP-003-9 requires owners of low-impact bulk electric system (BES) cyber systems to identify vendor remote access, disable it and detect malicious communications.
Medium
OT-ISAC maps Asia-Pacific policy rules for critical infrastructure and operational technology
OT-ISAC's report, current as of 20 October 2026, tracks Asia-Pacific policy.
Low
NineTenths joins ISASecure industrial cybersecurity certification programme
The International Society of Automation (ISA) announced that Saudi Arabia-based NineTenths has joined ISASecure. ISASecure certifies conformance to the ISA/IEC 62443 industrial cybersecurity standards.
Low
OT security firm Indurex raises €7 million
Indurex, which develops artificial intelligence for cyber-physical systems security, raised €7 million in a round led by Contrarian Ventures. Axeleo Capital and Curiosity also took part.
Critical
Siemens RUGGEDCOM CROSSBOW access controller has SQLite flaws; update available
The SQLite component inside RUGGEDCOM CROSSBOW Station Access Controller has multiple flaws. An attacker could run code, cause a denial of service or obtain sensitive information.
High
Siemens Industrial Edge App Publisher flaws could let a network attacker run code
Two flaws can be chained. An attacker on the network could impersonate the management server and run arbitrary code on the local machine. Siemens has released an update.
High
Siemens RUGGEDCOM CROSSBOW flaws allow database commands and privilege escalation
RUGGEDCOM CROSSBOW has multiple flaws. An attacker could run SQL commands on the database, retrieve administrative credentials, escalate privileges, change configurations or cause denial of service.
High
Siemens SIMATIC industrial PCs have a Secure Boot test-key flaw
A BIOS vendor test key sits in the UEFI Secure Boot key database. A local attacker with physical or administrative access could boot an operating system signed with it, bypassing Secure Boot.
High
Siemens SIMATIC WinCC database flaw lets a user run commands on the host
A database privilege flaw in several SIMATIC WinCC versions could let an authenticated user with database access run commands on the host system.
Critical
Siemens S7-1500 MFP controllers have many flaws in Linux subsystem
Multiple flaws exist in the extra GNU/Linux subsystem of firmware V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, including the SIPLUS variant.
Critical Known exploited
Siemens Software Center flaw lets local attacker run code; exploitation reported
Siemens Software Center loads DLL files from an uncontrolled search path. An authenticated local attacker could plant a crafted file and run code with the application's privileges. Siemens released a fixed version.
Low
Private firms fund $10 million cybersecurity support for small utilities
A private sector initiative launched this week will support up to 500 under-resourced utilities in improving their cybersecurity. The report gives the funding as $10 million.
Low
Experts say AI could help novices attack utilities and plants
Security experts say AI does not yet turn novices into nation-state attackers, but the potential is there. They say it speeds up research on documentation, reconnaissance and ways to exploit automation controllers.
High
Hitachi Energy MicroSCADA X SYS600 has CSV injection and authentication flaws
Hitachi Energy reported multiple vulnerabilities in MicroSCADA X SYS600, including CSV injection, where malicious formulas can alter spreadsheet data, exfiltrate data or run code, and an incorrect authentication…
Medium
Hitachi Energy warns of flaws in RTU500 CMU firmware
Hitachi Energy reported vulnerabilities in RTU500 series CMU firmware across several listed version ranges. If exploited, they could affect confidentiality, integrity and availability of the product.
High
Flaws in PEAK-System CAN drivers for Windows could crash the system
Several memory-handling flaws were found in HMS Networks PEAK-System PCAN Windows drivers. Successful exploitation could crash the Windows kernel. The vendor rates the flaws 7.1 on the CVSS v3 scale.
High
Moxa AIG-302 ThingsPro Edge flaws could expose sensitive data
Moxa AIG-302 ThingsPro Edge firmware up to 1.4.0 has two flaws: missing authorisation and a hard-coded cryptographic key. One lets a privileged attacker with adjacent network access read sensitive data, including keys.
Medium
India sets binding cybersecurity rules for the power sector from April 2027
India's Central Electricity Authority issued regulations for power sector cybersecurity, taking effect on 1 April next year.
High
Eclipse Milo flaws could expose credentials and stop servers responding
Several flaws in Eclipse Milo could let an attacker delete protected data, recover user credentials and impersonate users, or make the server stop responding to all clients. Rated 8.2 on CVSS v3.
High
Six flaws found in CISA's Malcolm network analysis software
Six flaws affect Malcolm, including authentication bypass, incorrect authorisation, server-side request forgery (SSRF), cross-site request forgery (CSRF) and data amplification. Rated 8.1 on CVSS v3.