What you need to know today.

Rockwell Automation industrial controllers are affected by multiple denial-of-service vulnerabilities. CVE-2025-11698, affecting boot firmware below version 1.072, and CVE-2025-12011 and CVE-2025-12012, impacting various controller models, allow remote attackers to load invalid projects or write invalid data, leading to a major non-recoverable fault. These issues require a power cycle to recover. CISA has issued advisories for these Rockwell Automation products, highlighting the potential for widespread disruption in industrial environments. As noted in CISA ICS Advisories, prompt patching or mitigation is crucial to prevent operational downtime.

Multiple Rockwell Automation Arena Simulation components are vulnerable to memory corruption flaws. CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, and CVE-2026-8314 all stem from improper validation of user-supplied data in various Siman executable components, leading to out-of-bounds writes. These vulnerabilities could result in system instability or crashes. CISA has released advisories detailing these issues in Rockwell Automation Arena, emphasizing the need for immediate attention from users of these simulation products.

AutomationDirect's Productivity Suite is susceptible to privilege escalation and system instability due to out-of-bounds write vulnerabilities. CVE-2026-60063 and CVE-2026-61389 allow local attackers to trigger kernel memory corruption via crafted IOCTL requests. This could enable an attacker to gain elevated privileges or cause denial of service. CISA has published an advisory for the AutomationDirect Productivity Suite, urging users to apply available patches to mitigate these risks.

Several Rockwell Automation communication modules and adapters face denial-of-service risks. CVE-2026-9653 affects 1756-EN2, EN3, and ENBT modules due to improper validation of CIP Implicit Connection packets, allowing network attackers to cause a DoS. Similarly, CVE-2026-12659 impacts other Rockwell products by improperly handling exceptional conditions when processing crafted CIP packets. CISA advisories for Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT and Rockwell Automation Flex 5000 Adapter detail these vulnerabilities, stressing the importance of network segmentation and timely updates.

PHP versions 8.0, 8.1, and 8.2 contain a vulnerability in the password_verify() function. CVE-2023-0567 allows the function to accept certain invalid Blowfish hashes as valid. If an invalid hash is stored in a password database, it could lead to application authentication bypass, potentially compromising user accounts. Developers should update to PHP 8.0.28, 8.1.16, or 8.2.3, or later, to address this critical flaw.

A critical arbitrary SQL execution and information disclosure vulnerability exists in the Snowflake Connector for Python. CVE-2026-15925 arises from improper TLS hostname verification, enabling an attacker to potentially execute arbitrary SQL commands and access sensitive information. Users of the Snowflake Connector for Python should update to a patched version immediately to prevent potential data breaches and system compromise.

Siemens SICAM 8 devices are affected by multiple vulnerabilities, including insufficient validation of authentication credentials, a flawed firmware update mechanism, and an accessible debugging interface. CVE-2026-54801 allows authenticated attackers to bypass security controls, CVE-2026-54799 enables the installation of malicious firmware, and CVE-2026-54798 permits authenticated attackers to crash the web process via a debugging interface, leading to denial of service. CISA's advisory for Siemens SICAM 8 provides further details on these risks.

NASA's Core Flight System (cFS) Health & Safety application has a vulnerability that can lead to a denial-of-service condition. CVE-2026-15352 allows a remote attacker to crash the application by sending a malformed routine Housekeeping Telemetry request, causing a segmentation fault. This could disrupt critical flight system operations. CISA has issued an advisory for the NASA Core Flight System (cFS) Health & Safety (HS) Application, recommending prompt application of security updates.

SALTO ProAccess Space software contains a privilege escalation vulnerability within its tenancy feature. CVE-2026-11889 allows an authorized attacker to gain access to all spaces managed by the affected product, potentially leading to unauthorized access and control over building security systems. CISA has released an advisory for SALTO ProAccess Space, urging users to implement necessary security measures.

Rockwell Automation FactoryTalk DataMosaix Private Cloud is vulnerable to stored cross-site scripting. CVE-2026-9292 stems from improper neutralization of user-supplied input within the Workflows configuration, allowing an authenticated attacker to inject malicious scripts. This could lead to session hijacking or other client-side attacks. CISA has issued an advisory for Rockwell Automation FactoryTalk DataMosaix, highlighting the need for prompt remediation.

Ansible AAP Gateway is vulnerable to an mTLS bypass. CVE-2026-12382 allows an attacker to spoof the Subject header, bypassing mutual TLS authentication. This could enable unauthorized access to sensitive systems or data. Administrators should ensure their Ansible deployments are updated to mitigate this security risk.