ICS Patch Tuesday: Schneider Electric, Siemens, and Others Address Critical Flaws
Schneider Electric, Siemens, Aveva, and Rockwell Automation have released patches for critical and high-severity vulnerabilities affecting their industrial control system products.
September's Industrial Control Systems (ICS) Patch Tuesday has seen major vendors like Schneider Electric and Siemens issuing significant updates to address a range of vulnerabilities. Schneider Electric, in particular, released four new security advisories and updated four existing ones, highlighting ongoing efforts to secure critical infrastructure.
The most critical flaw addressed by Schneider Electric is CVE-2026-3869, an authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers, carrying a CVSS score of 9.2. The company also resolved high-severity bugs in its PowerLogic T300 platform and EcoStruxure IT Data Center Expert product, alongside a medium-severity defect in SCADAPack x70 products. These updates underscore the persistent need for vigilance in securing operational technology (OT) environments.
Siemens has been equally active, publishing nine new advisories and updating nine others. Four of these new advisories tackle critical-severity vulnerabilities found in Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT. Additionally, Siemens is rolling out updates to address the Copy Fail Linux kernel vulnerability (CVE-2026-31431), which could allow attackers to gain root shell access.
Aveva has also published advisories detailing four flaws within the PIMBoards component of its Pipeline Integrity Monitor. Two of these are high-severity, including an issue with a hardcoded encryption key that could expose sensitive information and a flaw where MD5-hashed passwords might be reverse-engineered. A medium-severity unsafe deserialization vulnerability in Enterprise SCADA also poses a risk of remote code execution.
Rockwell Automation is not far behind, having released nine security advisories that cover critical and high-severity flaws across several of its products. These include issues in RSLinx Classic, the 1756-ENBT module, FactoryTalk Historian Machine Edition (ME), and various controller platforms like CompactLogix and GuardLogix.
The regular cadence of these ICS Patch Tuesdays, coupled with advisories from CISA for a broad spectrum of vendors including CareCam, Tycon Systems, and Johnson Controls, indicates a challenging landscape for ICS security. The sheer volume and variety of vulnerabilities being disclosed emphasize the interconnectedness of IT and OT security and the need for robust patch management strategies.
These updates are crucial for organizations operating critical infrastructure, as exploited vulnerabilities in ICS can lead to significant operational disruptions, safety incidents, and potential physical damage. The ongoing discovery and patching of these flaws highlight the dynamic nature of cybersecurity threats in the OT space and the continuous effort required to maintain system integrity and resilience.
CISA has issued an advisory for CVE-2026-81861, a medium-severity vulnerability affecting Schneider Electric's SCADAPack x70 products, including several RTU models. This flaw could permit unauthorized access to RTU configurations via the Secure Lock functionality, potentially leading to a loss of confidentiality. Schneider Electric recommends implementing Role-Based Access Control (RBAC) and network segmentation as primary mitigations, advising that RBAC should supersede the legacy Secure Lock feature where possible.
CISA has issued an alert for CVE-2026-13348, a critical vulnerability affecting Schneider Electric's PowerChute Serial Shutdown software, specifically versions 1.5 and prior, as well as version 1.6. The flaw, categorized as an improper restriction of excessive authentication attempts (CWE-307), could permit attackers to bypass authentication and gain unauthorized access through unlimited login attempts. Schneider Electric has released version 1.6 of the software as a fix for this vulnerability.
This advisory details two specific critical vulnerabilities affecting Schneider Electric's NetBotz 5 750/755 security and environmental monitors. CVE-2026-13336 allows OS command injection via maliciously modified system backups, while CVE-2026-13337 is an SQL injection flaw in the Hibernate framework. These issues could lead to device manipulation and unauthorized data access, with affected versions including 5.5.2 and prior.
Siemens has issued further details regarding the "Copy Fail" vulnerability (CVE-2026-31431) affecting its SIPLUS and SIMATIC product lines. The advisory specifically names numerous SIMATIC HMI MTP models and SIMATIC AX Runtime Core Linux versions as impacted, with Siemens releasing updated versions for some and recommending specific workarounds for others where patches are not yet available.