Multiple Vulnerabilities in Eclipse Milo Could Impact Critical Infrastructure
CISA has issued an advisory detailing six vulnerabilities in Eclipse Foundation Eclipse Milo, affecting versions 0.6.0 through 1.1.4, with potential impacts ranging from data deletion to denial-of-service conditions.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory highlighting multiple vulnerabilities within the Eclipse Foundation's Eclipse Milo software, a critical component used in industrial control systems (ICS).
These vulnerabilities, affecting versions 0.6.0 through 1.1.4, pose significant risks to organizations operating in sectors such as chemical, critical manufacturing, energy, and water and wastewater. The flaws, identified by CISA and detailed in the advisory (ICSA-26-288-01), could allow attackers to delete protected data, impersonate legitimate users by recovering their credentials, or cause denial-of-service conditions, rendering systems unresponsive.
Several specific Common Vulnerabilities and Exposures (CVEs) have been assigned to these issues. CVE-2026-63252, CVE-2026-63248, and CVE-2026-60007 are present in Eclipse Milo versions 0.6.0 through 1.1.4. These vulnerabilities stem from issues such as incorrect authorization and the failure to release memory after it's no longer needed, which can be exploited to exhaust system resources.
Additionally, CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387 impact Eclipse Milo versions 1.0.0 through 1.1.4. These flaws relate to missing authorization checks and observable response discrepancies, potentially allowing anonymous or low-privileged clients to execute unauthorized actions or gain access to sensitive information.
The potential impact of these vulnerabilities is severe. Successful exploitation could lead to the deletion of critical data, the compromise of user identities through credential recovery, or a complete cessation of server operations, leading to widespread disruption in operational technology environments.
The Eclipse Foundation has released version 1.1.5 of Eclipse Milo to address these security concerns. Users are strongly advised to upgrade to this latest version to mitigate the risks. For those operating on older 0.6.x versions, a direct upgrade to 1.1.5 or a later release is necessary, as no fixes are available for the 0.6.x branch.
These vulnerabilities have been assigned high severity ratings, with CVSS v3.1 scores reaching up to 8.2 and CVSS v4.0 scores as high as 8.8. The advisory underscores the importance of timely patching and security updates for software used in critical infrastructure, emphasizing the potential for widespread impact if these flaws are exploited.