ICS Vulnerabilities Dominate Daily CVE Briefing

Multiple vulnerabilities in Labcenter Proteus 9 could allow an attacker to execute arbitrary code. Specifically, CVE-2026-49033 is a stack-based buffer overflow, CVE-2026-42958 is a use-after-free vulnerability, and CVE-2026-42953 is an out-of-bounds write. These flaws could be exploited by an attacker to gain control of the affected system, posing a significant risk to industrial control systems. As detailed in CISA ICS Advisory ICSA-26-188-06, these vulnerabilities require an attacker to have local access or trick a user into opening a specially crafted file.

Hydro-Québec's charging station backend is affected by several critical vulnerabilities, including CVE-2026-20744, which allows privilege escalation through an unauthenticated websocket endpoint. Additionally, CVE-2026-44383 permits the deployment of multiple malicious clients by bypassing authentication for multiple connections, and CVE-2026-42952 enables denial-of-service attacks due to a lack of throttling on authentication attempts. These issues, as outlined in CISA ICS Advisory ICSA-26-188-01, could disrupt operations and compromise the integrity of the electric vehicle charging infrastructure.

Digi International devices, including the PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA, have multiple vulnerabilities. CVE-2026-12352 allows unauthenticated actors to bypass authentication and access restricted resources. Furthermore, CVE-2026-12948 is a stored cross-site scripting (XSS) vulnerability in the web management interface, enabling authenticated administrators to inject scripts. These issues, highlighted in CISA ICS Advisory ICSA-26-188-07, could lead to unauthorized access and potential system compromise.

Several vulnerabilities have been disclosed in 389 Directory Server (389 Ds Base). CVE-2026-11610 involves a heap buffer overflow in sasl_io_recv(), while CVE-2026-14940 is another heap buffer overflow related to DN normalization. Additionally, CVE-2026-14969 points to a static initialization vector in attribute encryption using AES-CBC/3DES-CBC. These flaws could potentially lead to denial-of-service or information disclosure, impacting the security of directory services.

The open-source debugging tool radare2 is affected by nine local vulnerabilities, with exploits for CVE-2026-14787 already publicly available, as reported by Vypr Intelligence. One of these, CVE-2026-14787, involves an integer overflow in the cmd_print function within the pb Print Command Handler. The public availability of exploits for these local vulnerabilities increases the risk of their exploitation in targeted attacks.

Siemens Mendix Studio Pro versions are impacted by CVE-2026-48192, a vulnerability where the software does not properly validate or sanitize project files during the build pipeline. This could allow an attacker to trick a user into opening a malicious project, potentially leading to compromise. CISA ICS Advisory ICSA-26-188-04 provides further details on this security risk.

Hitachi Energy's PROMOD V is vulnerable due to insecure HTTP communication instead of HTTPS, as detailed in CISA ICS Advisory ICSA-26-188-02. CVE-2026-10763 specifically highlights the lack of HTTPS support from the Digipede server, which could expose sensitive data transmitted between systems.

SSSD (System Security Services Daemon) has two disclosed vulnerabilities. CVE-2026-14474 allows for privilege escalation by searching the entire directory tree for sudoRole objects by default. CVE-2026-14476 enables Kerberos authentication bypass through path traversal in the GPO cache. These vulnerabilities could allow unauthorized users to gain elevated privileges or bypass authentication mechanisms.