Vendors and CVEs › Vendors › ABB
ABB: industrial cyber security news and vulnerabilities
5 stories in Industrial Cyber Brief name ABB, 2 on CISA’s list of known exploited flaws, from Wednesday 21 October 2026 to Saturday 7 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Critical Known exploited
ABB IPEC iSM Local Server has flaws in PHP and NTFS-3G
ABB reports public vulnerabilities in third-party components (PHP and NTFS-3G) in the IPEC iSM Local Server. An attacker could insert and run arbitrary code. ABB has had no reports of active exploitation.
Critical Known exploited
ABB gateway and NAM products hit by PHP flaws now listed as exploited
New: CISA now lists these PHP flaws as known exploited. ABB says an attacker could insert and run arbitrary code on affected products. The highest stated CVSS score is 9.8. Covers CVE-2026-109618 and CVE-2026-109619.
Medium
ABB ASPECT building management system has PHP flaws allowing code execution
ABB reported PHP vulnerabilities in ASPECT versions listed in its advisory. An attacker could run arbitrary code. ABB is still investigating.
High
Hitachi Energy MicroSCADA X SYS600 has CSV injection and authentication flaws
Hitachi Energy reported multiple vulnerabilities in MicroSCADA X SYS600, including CSV injection, where malicious formulas can alter spreadsheet data, exfiltrate data or run code, and an incorrect authentication…
Medium
Hitachi Energy warns of flaws in RTU500 CMU firmware
Hitachi Energy reported vulnerabilities in RTU500 series CMU firmware across several listed version ranges. If exploited, they could affect confidentiality, integrity and availability of the product.