Vendors and CVEs › Sectors › Manufacturing
Manufacturing: industrial cyber security news for the sector
25 stories in Industrial Cyber Brief name Manufacturing, 2 on CISA’s list of known exploited flaws, from Sunday 18 October 2026 to Tuesday 10 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Critical
OpenSSL flaws affect many B&R automation products and panels
B&R reports OpenSSL vulnerabilities in a range of its products. An attacker who exploits them could stop a product or insert and run arbitrary code. The highest stated CVSS score is 9.8.
Low
Ransomware victims up 80% in third quarter, manufacturing hit hardest
Bridewell recorded 2,889 publicly disclosed ransomware victims across 111 groups in the third quarter of 2026, up 80% on a year earlier. Qilin was the most active group. Manufacturing made up 16.4% of victims.
Medium
Updated Mitsubishi Electric advisory on CC-Link IE TSN tampering and denial-of-service flaw
Mitsubishi Electric updated its advisory on a flaw in the CC-Link IE TSN industrial communication protocol that allows information tampering and denial of service. The feed gave no body text, so no details are available.
Low
ODVA's CIP Security certified to IEC 62443-4-2 Security Level 3
ODVA announced that TÜV Rheinland has certified CIP Security against IEC 62443-4-2 at Security Level Capability 3. CIP Security adds data integrity, authentication, authorisation and TLS/DTLS encryption to EtherNet/IP.
Low
BaseRock and Radiflow add continuous OT risk monitoring to IEC 62443 advice
UK firm BaseRock IT Solutions has partnered with Radiflow.
Critical
Subnet Solutions PowerSYSTEM Center has flaws allowing SQL commands and admin access
CISA lists two flaws in PowerSYSTEM Center: incorrect authorisation lets a low-privileged logged-in user reach administrator-only resources, and SQL injection could allow unauthorised database commands.
Medium
AI use in industrial security is growing faster than the safeguards
A Takepoint Research report found 87.7% use AI in OT cybersecurity, but only 7.9% use it across all functions. Data quality (45.4%) and legacy integration (42.4%) are the main challenges.
Critical Known exploited
Known-exploited PHP flaws hit Festo Didactic and WAGO products
Now listed by CISA as known exploited. The PHP bundled with Festo Didactic FactoryViews and MES4 (with xampp) has two critical flaws, CVE-2026-109618 and CVE-2026-109619 ('PHP2Shell').
Medium
Penetration tester finds Windows 7 servers linked to factory milling machines
A penetration tester visited a factory that had been hacked six months earlier. He found Windows 7 servers connected to computer numerical control (CNC) milling machines. Most were not joined to the domain.
Critical
EPICS Base has four flaws, including possible remote code execution
EPICS Base release 7.0.10 and earlier has four flaws (CVE-2026-114595 to CVE-2026-114598). They could cause denial of service, memory corruption, data disclosure or code execution.
Low
Manufacturers struggle to share security duties and budgets between IT and OT
An analysis says manufacturing security projects stall because accountability, funding and responsibility sit in different places.
Medium
Lazarus spies on South Korean firms using abused security software
Kaspersky attributes Operation FlashHole to North Korea-linked Lazarus Group. It targets at least three South Korean organisations in construction, software and wire-communication equipment manufacturing.
Low
Schneider Electric, NVIDIA and HPE announce AI agents for industrial sites
Schneider Electric announced a collaboration with NVIDIA and HPE on "Physical AI" for process and heavy industries.
Low
AhnLab pushes combined IT and OT security in Japan
AhnLab is aiming its combined IT and operational technology (OT) security offer at Japanese manufacturing, according to a news headline. The report gives no further detail and describes no flaw or incident.
Critical
Siemens RUGGEDCOM CROSSBOW access controller has SQLite flaws; update available
The SQLite component inside RUGGEDCOM CROSSBOW Station Access Controller has multiple flaws. An attacker could run code, cause a denial of service or obtain sensitive information.
High
Siemens Industrial Edge App Publisher flaws could let a network attacker run code
Two flaws can be chained. An attacker on the network could impersonate the management server and run arbitrary code on the local machine. Siemens has released an update.
High
Siemens RUGGEDCOM CROSSBOW flaws allow database commands and privilege escalation
RUGGEDCOM CROSSBOW has multiple flaws. An attacker could run SQL commands on the database, retrieve administrative credentials, escalate privileges, change configurations or cause denial of service.
High
Siemens SIMATIC industrial PCs have a Secure Boot test-key flaw
A BIOS vendor test key sits in the UEFI Secure Boot key database. A local attacker with physical or administrative access could boot an operating system signed with it, bypassing Secure Boot.
High
Siemens SIMATIC WinCC database flaw lets a user run commands on the host
A database privilege flaw in several SIMATIC WinCC versions could let an authenticated user with database access run commands on the host system.
Critical
Siemens S7-1500 MFP controllers have many flaws in Linux subsystem
Multiple flaws exist in the extra GNU/Linux subsystem of firmware V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, including the SIPLUS variant.
Critical Known exploited
Siemens Software Center flaw lets local attacker run code; exploitation reported
Siemens Software Center loads DLL files from an uncontrolled search path. An authenticated local attacker could plant a crafted file and run code with the application's privileges. Siemens released a fixed version.
Low
Experts say AI could help novices attack utilities and plants
Security experts say AI does not yet turn novices into nation-state attackers, but the potential is there. They say it speeds up research on documentation, reconnaissance and ways to exploit automation controllers.
Low
Mitsubishi Electric announces new security product for industrial equipment
Mitsubishi Electric has developed a new operational technology (OT) security solution for industrial equipment, according to a Business Wire headline. The report gives no technical detail.
High
Moxa AIG-302 ThingsPro Edge flaws could expose sensitive data
Moxa AIG-302 ThingsPro Edge firmware up to 1.4.0 has two flaws: missing authorisation and a hard-coded cryptographic key. One lets a privileged attacker with adjacent network access read sensitive data, including keys.
High
Eclipse Milo flaws could expose credentials and stop servers responding
Several flaws in Eclipse Milo could let an attacker delete protected data, recover user credentials and impersonate users, or make the server stop responding to all clients. Rated 8.2 on CVSS v3.