Daily OT Security News: November 01, 2026
Source verification: This edition is based only on the verified advisories, vulnerability records, and reporting listed below.
1. EPICS Base flaws expose control-system deployments to potential code execution
Source date
October 27, 2026
News briefing
CISA’s October 27 advisory ICSA-26-300-01 identifies four vulnerabilities in EPICS Base releases 7.0.10 and earlier: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, and CVE-2026-114598. CISA reports a CVSS v3 score of 9.8 and says successful exploitation could cause denial of service, memory corruption, sensitive-information disclosure, or potentially arbitrary code execution. SecurityWeek reports that the flaws involve Channel Access and pvAccess network communications and that CISA recommends updating to EPICS Base 7.0.11. Its reporting describes scientific-facility control use, while CISA separately identifies Critical Manufacturing as the advisory’s sector and says deployments are worldwide. CISA reported no known public exploitation targeting these vulnerabilities at publication. These descriptions do not establish demonstrated remote code execution or known internet-facing deployments. The advisory’s sector classification does not mean that every EPICS deployment is in manufacturing.
OT implications
Organizations that use EPICS Base should first verify installed releases and identify the systems that depend on its communications. Where affected releases are present, the reported recommendation to update to 7.0.11 can inform a controlled maintenance plan, with testing appropriate to the deployment. Teams should assess network reachability and consider segmentation rather than assume external exposure. Scientific-facility and manufacturing operators should evaluate their own application context separately; the advisory’s sector label is not a substitute for local inventory, dependency review, or risk assessment.
Sources
2. Mitsubishi Electric and ICONICS disclose a broad GENESIS, HMI, and historian vulnerability set
Source date
October 15–29, 2026
News briefing
CISA advisory ICSA-26-300-02 covers GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. It identifies Critical Manufacturing as the sector and describes worldwide deployment. Mitsubishi Electric PSIRT advisory 2026-006 lists CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, and CVE-2026-16438. The vendor describes CVE-2023-4863 as an out-of-bounds-write issue involving libwebp that can allow code execution. CVE-2026-16436 and CVE-2026-16437 involve the security-challenge/password-recovery mechanism, while CVE-2026-16438 concerns DCOM permissions and arbitrary operations. The vendor lists fixes for several product lines but says no fixed versions are planned for MC Works64, GENESIS32, or BizViz; it provides mitigations for those products. Exploit preconditions vary across the issues, so the disclosure should not be read as making every vulnerability remote or unauthenticated.
OT implications
Organizations using any listed product should map the advisory to their exact product line and version before selecting a response. A single patch assumption would miss the vendor’s distinction between products with listed fixes and products for which only mitigations are provided. Where applicable, teams should review those vendor mitigations, assess access paths and permissions, and schedule supported updates through controlled maintenance. Risk assessment should preserve each vulnerability’s prerequisites rather than treating the entire set as remotely exploitable without authentication. Inventory and ownership records can help coordinate that review.
Sources
3. Siemens Mendix SAML flaw enables replay-based authentication bypass in industrial app deployments
Source date
October 26–29, 2026
News briefing
CISA advisory ICSA-26-302-01 and Siemens ProductCERT SSA-137528 describe CVE-2026-89209, an authentication bypass by capture-replay in the Siemens Mendix SAML module. A remote unauthenticated attacker could gain unauthorized application access by replaying a valid SAML assertion in an IdP-initiated authentication flow. Affected releases are Mendix 10- and 11-compatible module versions before 4.2.4 and Mendix 9-compatible versions before 3.6.29. Siemens recommends updating to 4.2.4 or later for Mendix 10/11, or 3.6.29 or later for Mendix 9. Disabling IdP-initiated SSO is a listed mitigation. CISA identifies Critical Manufacturing and Information Technology among deployment sectors and reports worldwide deployment. The described issue concerns application identity and unauthorized access, not a reported controller compromise or code-execution vulnerability.
OT implications
Organizations using Mendix should verify the SAML module’s compatibility branch, installed version, and use of IdP-initiated authentication before determining applicability. If an affected module is present, application and identity owners should review the vendor’s update guidance and assess whether disabling IdP-initiated SSO is an appropriate interim mitigation. Any change should be coordinated with application access requirements and tested through controlled maintenance. OT teams should treat this as an identity and application-access review, not evidence that controllers or physical processes have been compromised.
Sources
4. Hitachi Energy TRO600 disclosure calls for energy-sector exposure review
Source date
October 27–29, 2026
News briefing
CISA advisory ICSA-26-302-02 addresses CVE-2026-10756 and CVE-2026-106087 in Hitachi Energy TRO600 series products. Its collective summary identifies potential remote code execution and sensitive-information disclosure. CISA classifies the issues as improper restriction of a communication channel to intended endpoints and missing authentication for a critical function, with a vendor-equipment CVSS v3 value of 7.5. The official CVE-2026-10756 record describes an authenticated attacker bypassing network access restrictions through port forwarding to reach localhost-only services. The CVE-2026-106087 record describes unauthenticated arbitrary file reading that may expose configuration files and password data. CISA identifies Energy as the sector and recommends minimizing network exposure, firewalling and isolating control-system networks, and securing remote access. The collective summary does not assign remote code execution to either individual CVE.
OT implications
Energy-sector teams should determine whether TRO600 products are present and review actual network access controls and remote-access arrangements before drawing exposure conclusions. If relevant equipment is identified, CISA’s recommendations provide a basis for assessing firewall rules, isolation, and unnecessary reachability. Reviewers should keep the authenticated port-forwarding scenario separate from the unauthenticated file-reading issue and avoid treating them as identical attack paths. Any changes to access controls should be coordinated with operational owners. The available evidence does not supply a fixed version, so update planning requires additional vendor guidance rather than an assumed release.
Sources
5. Hitachi Energy CoreTec advisory pairs OS command injection with a write-what-where condition
Source date
October 27–29, 2026
News briefing
CISA advisory ICSA-26-302-03 reports OS command injection and Dirty Frag vulnerabilities in Hitachi Energy CoreTec products, with potential effects on confidentiality, integrity, and availability. CoreTec5 versions 3.4.0 and earlier and 5.0.0 are listed as affected by CVE-2026-13162 and CVE-2026-43284. CoreTec4 versions 3.4.0 and earlier are listed as affected by CVE-2026-13162. CISA classifies the issues as OS command injection and a write-what-where condition. Its displayed CVSS v3 value of 8.8 appears in the CoreTec5 vendor/equipment block; it should not be generalized to all versions or both CVEs. CISA identifies Energy, reports worldwide deployment, and recommends minimizing network exposure and segmenting control-system networks from business networks. WaterISAC independently lists the CoreTec alert among CISA’s October 29 ICS advisories and identifies it as energy-related.
OT implications
Organizations with CoreTec equipment should distinguish CoreTec4 from CoreTec5 and verify the listed versions before assessing applicability. Risk records should retain the advisory’s product-specific CVE associations and the limited placement of the 8.8 score, rather than flattening them into a single severity statement. CISA’s exposure and segmentation recommendations can guide a review of actual network boundaries where relevant. Operational owners should approve any resulting changes. The supplied evidence does not establish a precise attack path or exploit prerequisites, so teams should avoid building response plans around an assumed exploitation scenario.
