Daily OT Security News: October 16, 2026

1. Eclipse Milo flaws could expose OPC UA data or credentials, bypass authorization, or disrupt servers

News briefing

CISA published ICSA-26-288-01 on October 15, 2026, warning that Eclipse Foundation’s Milo OPC UA stack has six listed CVEs: CVE-2026-63252, CVE-2026-63248, CVE-2026-60007, CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387. The CISA header says five vulnerabilities even though the advisory lists six CVE identifiers. CISA identifies chemical, critical manufacturing, energy, and water/wastewater as relevant sectors. 1

Affected ranges are 0.6.0–1.1.4 for CVE-2026-63252, CVE-2026-63248, and CVE-2026-60007, and 1.0.0–1.1.4 for CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387. Potential outcomes across the listed flaws include protected-data deletion, credential or session-information exposure/recovery and impersonation, authorization bypass, and server nonresponse. 1

Prerequisites differ. CVE-2026-60007 is a Basic128Rsa15 username-token padding oracle: an on-path attacker must capture a victim token, then make repeated unauthenticated ActivateSession requests; its CVSS v4.0 score is 9.1 Critical. 2 CVE-2026-58080 concerns a RoleMapper dropped by OpcUaServerConfig.copy(); role checks may be skipped where a server relies on RoleMapper and permits anonymous sessions; CVSS v4.0 is 8.8 High. 3 CVE-2026-62927 may let an anonymous or low-privileged client execute a denied method through a mixed-batch Call authorization/dispatch flaw; CVSS v4.0 is 8.7 High. 4

CVE-2026-63248 is an OPC UA diagnostics authorization flaw that may expose session-security information; CVSS v4.0 is 6.9 Medium. 5 CVE-2026-61387 permits unauthenticated crafted nested ExtensionObjects to exhaust a global monitored-item quota; existing monitored items and other server functions remain unaffected; CVSS v4.0 is 6.9 Medium. 6 CVE-2026-63252 can allow unauthenticated remote clients to exhaust pooled direct memory through repeated incomplete chunks and disconnects; CVSS v4.0 is 8.7 High. 7 NVD likewise describes versions before 1.1.5 as affected for that direct-memory exhaustion issue. 8

Eclipse’s v1.1.5 release notes list fixes matching all six flaw classes. Confirm the dependency and a compatible upgrade path for deployed applications before upgrading. CISA’s advisory-level vendor-equipment score is CVSS v3 8.2, while individual records use CVSS v4.0 scores from 6.9 to 9.1; do not compare these directly. The CISA advisory does not state that the flaws are exploited in the wild or attribute them to an incident. The retrieved KEV catalog excerpt was truncated, so KEV absence was not established. 1 3 5 7

What to do

1. Inventory Java applications, gateways, engineering workstations, and vendor appliances that embed Eclipse Milo; use dependency/SBOM and build records—not just network scans—to identify versions and OPC UA endpoints.
2. Ask the equipment or software supplier for a supported update path to Milo 1.1.5 or later, including validated downstream builds. Test in representative lab or staging environments for protocol interoperability, authentication, role permissions, failover, and safety-related operation; then deploy in an approved maintenance window with rollback prepared.
3. Until a compatible update is validated, reduce exposure: keep OPC UA services off the public internet, segment them behind controlled firewalls, restrict client access and remote administration, and use a monitored VPN where remote access is necessary. Assess operational impact before changes.
4. Review configurations for anonymous access, RoleMapper/copy usage, Basic128Rsa15 username-token policies, and diagnostics exposure. Monitor unusual session/authentication failures, incomplete-message disconnects, and bursts of CreateMonitoredItems/Call activity; preserve logs and follow incident procedures if suspicious activity appears.

Sources

• 1 Eclipse Foundation Eclipse Milo — CISA ICS Advisory ICSA-26-288-01 — October 15, 2026 (initial release). Affected ranges, listed CVEs, potential impacts, relevant sectors, advisory-level CVSS v3 8.2, and advisory header/listing discrepancy.
• 2 CVE-2026-60007 — CVE Record — CVE record date not exposed; NVD published August 4, 2026 and last modified August 5, 2026. Padding-oracle prerequisites and CVSS v4.0 9.1.
• 3 CVE-2026-58080 — CVE Record — CVE record date not exposed; NVD published August 4, 2026 and last modified August 5, 2026. RoleMapper configuration condition and CVSS v4.0 8.8.
• 4 CVE-2026-62927 — CVE Record — CVE record date not exposed; NVD published August 4, 2026 and last modified August 5, 2026. Mixed-batch Call authorization/dispatch issue and CVSS v4.0 8.7.
• 5 CVE-2026-63248 — CVE Record — CVE record date not exposed; NVD published August 4, 2026 and last modified August 5, 2026. Diagnostics authorization issue and CVSS v4.0 6.9.
• 6 CVE-2026-61387 — CVE Record — CVE record date not exposed; NVD published August 4, 2026 and last modified August 5, 2026. Nested ExtensionObject quota exhaustion, unaffected existing monitored items/other functions, and CVSS v4.0 6.9.
• 7 CVE-2026-63252 — CVE Record — CVE record date not exposed; NVD published August 4, 2026 and last modified August 5, 2026. Direct-memory exhaustion mechanism and CVSS v4.0 8.7.
• 8 CVE-2026-63252 Detail — NVD — Published August 4, 2026; last modified August 5, 2026. Affected range before 1.1.5 and unauthenticated remote server-termination risk.
• 9 Eclipse Milo v1.1.5 release notes — Release date not exposed in retrieved page. Fixes corresponding to all six issue classes.

2. Guangzhou Juan IoT Technology EseeCloud

News briefing

CISA’s October 15, 2026 advisory covers three vulnerabilities in Guangzhou Juan IoT Technology’s EseeCloud app versions 4.9.6 and earlier and firmware versions 4.9.86.0 and earlier: CVE-2026-107617, CVE-2026-97858, and CVE-2026-105664. CISA lists the categories as use of hard-coded credentials, improperly controlled modification of dynamically determined object attributes, and observable response discrepancy. Successful exploitation could allow an attacker to gain control over affected IP cameras. 10

CISA displays one grouped Vendor Equipment CVSS v3 9.8 rating. It does not provide individual CVSS scores or vectors for the three CVEs, exploit prerequisites, or a fixed EseeCloud version. CISA says it had received no reports of known public exploitation specifically targeting these vulnerabilities at the time of the advisory; that point-in-time statement is not proof that exploitation has not occurred. 10

WaterISAC independently corroborates CISA’s October 15 publication date. The three CVE.org records were still marked reserved when checked, so they supplied no independently available technical description, vector, or affected-version detail. No incident attribution or actual exploitation is asserted here. 11 13

What to do

1. Inventory EseeCloud deployments, including app and camera firmware versions, and identify assets at or below the affected thresholds (app ≤4.9.6; firmware ≤4.9.86.0). Confirm exact versions with device owners rather than inferring them from product names.
2. Reduce unnecessary exposure and segment camera/control networks from business networks. Before firewall, routing, or remote-access changes, test in a representative staging environment or controlled change window; verify live video, recording, alarm/monitoring, and required management access continue to work.
3. Check with Guangzhou Juan and CISA for authoritative remediation before upgrading; CISA’s advisory does not name a fixed release. If a vendor update becomes available, test it on a representative noncritical device first, validate integrations and recording, and prepare a rollback plan before fleet rollout.
4. Review camera access and configuration logs for anomalous administrative access or changes, preserve evidence if suspicious activity is found, and follow incident-reporting procedures. Treat the absence of known public exploitation as a point-in-time report, not assurance of safety.

Sources

• 10 Guangzhou Juan IoT Technology EseeCloud — CISA ICS Advisory ICSA-26-288-02 — October 15, 2026 (initial release). Affected app/firmware thresholds, CVEs, categories, grouped CVSS v3 9.8, camera-control impact, mitigations, and CISA’s no-known-public-exploitation statement.
• 11 (TLP:CLEAR) CISA ICS Advisories, Additional Alerts, Updates, and Bulletins – October 15, 2026 — October 15, 2026 (created 14:42). Independent corroboration of advisory publication date.
• 12 CVE Record: CVE-2026-107617 — No publication date shown; accessed October 16, 2026. Record reserved by CNA; details not yet available.
• 13 CVE Record: CVE-2026-97858 — No publication date shown; accessed October 16, 2026. Record reserved by CNA; details not yet available.
• 14 CVE Record: CVE-2026-105664 — No publication date shown; accessed October 16, 2026. Record reserved by CNA; details not yet available.

3. FERC identifies cybersecurity compliance gaps in US power sector, flags risks from AI tools and third-party control systems

News briefing

FERC announced on October 13, 2026 that staff issued lessons from fiscal 2026 audits of several NERC-registered electric-sector entities; the announcement page was updated October 14. Industrial Cyber’s October 15 coverage says most reviewed cybersecurity processes met mandatory CIP Reliability Standards, while potential noncompliance and security risks remained. The report summarizes audit observations and voluntary practices; it does not find that the entire sector failed compliance. 15

The reported themes are: delayed NERC registration and CIP-002-5.1a identification/categorization of qualifying generation resources—including inverter-based resources after commercial operation; affiliate or third-party generation monitoring/control whose aggregate capability may warrant a higher impact categorization than each GOP assigned individually; and access governance for AI or “super intelligence” tools in CIP-networked environments. The coverage cites CIP-004-7 access authorization, review, and revocation provisions alongside considerations for other CIP standards. These recommendations are not a blanket prohibition on AI tools. 16

FERC’s announcement confirms the report and timing; detailed findings are cross-corroborated by Industrial Cyber and Ampyx Cyber because the report PDF itself was not accessible through the FERC page extraction. The coverage identifies no CVEs, CVSS scores, affected product versions, product fix, or named incident attribution. FERC’s reported reference to real-world intrusions does not identify a specific event or attribute an attack to a named actor or tool. 15 17

What to do

1. Reconcile generation projects and phased interconnection milestones with NERC commercial-operation and BES-threshold triggers. Assign owners for timely registration and CIP-002-5.1a reviews; retain dated evidence of each trigger, analysis, and decision.
2. Map every affiliate, vendor, contractor, and shared operations center able to monitor or control generation. Assess aggregation against applicable impact criteria with compliance counsel or the Regional Entity, document the conclusion, and verify contractual accountability and access boundaries.
3. Inventory AI-enabled tools and services in CIP-networked environments, including vendor-added features. For each, record business need, identity/service account, authorized systems and BCSI, external communications, accountable owner, access-review date, revocation path, and supply-chain assessment.
4. Validate proposed access, account, egress, or configuration changes in a representative lab or non-production environment first. Use approved change control, operations/vendor coordination, backups and rollback plans, outage windows where needed, and post-change checks; do not experiment on live control systems.

Sources

• 15 FERC Staff Report Offers Lessons Learned from 2026 CIP Audits — October 13, 2026; page last updated October 14, 2026. Primary confirmation of the FY2026 CIP audit lessons report and release/update timing; full findings were not exposed in extracted page content.
• 16 FERC identifies cybersecurity compliance gaps in US power sector, flags risks from AI tools and third-party control systems — October 15, 2026. Detailed reporting on the three audit lessons, related standards, and the fact that most reviewed processes met mandatory requirements.
• 17 FERC 2026 CIP Audit Findings: Generator Registration, Aggregated Control, and AI Tool Access — October 15, 2026. Independent secondary cross-check of the three lessons and related standards.
• 18 ERO Enterprise Registration Procedure — June 11, 2026. Official registration-procedure document relevant to registration timing/COD context; downloaded PDF text could not be extracted here, so no detailed wording is relied upon.

4. MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques

News briefing

MITRE’s ATT&CK v20, whose release began October 13, 2026, expands coverage of industrial control system behavior and recent campaigns. It adds ICS Command and Scripting Interpreter (T1701) with six interpreter-specific sub-techniques, replacing deprecated T0807 and T0853 mappings. It also adds DNS and publish/subscribe protocol sub-techniques under T0869 for C2 over commonly used application-layer protocols. ICS Detection Strategies now specify applicable platforms and asset types, with analytics intended to distinguish suspicious execution from routine engineering and maintenance activity. These are framework updates for organizing threat behavior and detection—not a vulnerability advisory or evidence that every mapped technique was used in every incident. 19 27

MITRE campaign C0066 records attacks affecting more than 30 Minnesota water and wastewater utilities, including exposed PLC access and operators locked out after password or IP changes. MITRE says that activity has not been formally attributed. FBI/EPA and CISA separately warned in July of exposed PLC attacks reported across at least seven states, with reported password/IP changes and some operational degradation, and urged removal of direct internet exposure, stronger access control, logic/backup review, and preparation for safe manual operations. 21 23

Separately, MITRE campaign C0064 documents an AI-assisted campaign across Mexican government organizations that included the SADM Monterrey water utility. Importantly, Gambit documented utility IT compromise and access to procurement records; Dragos reports an attempted pivot toward an OT-adjacent SCADA/IIoT gateway, unsuccessful password-spray attempts, and no observed breach of the OT environment. These findings do not establish successful plant-control-system compromise. 24 26

MITRE’s mappings give defenders a shared vocabulary, but do not establish attribution or replace site-specific risk assessment. 19 24

What to do

1. Inventory internet-facing PLCs, cellular modems, gateways, and undocumented vendor connections. Plan removal of direct exposure through a secure, monitored gateway; test the access change in a maintenance window, validate authorized remote engineering and failover, and confirm operators can maintain safe process control before closing the change.
2. Review PLC credentials, allowlists, and configuration/logic integrity against known-good records. Before changing passwords, network settings, key-switch modes, or restoring a program, preserve verified backups and coordinate with controls engineers; test recovery and manual-operation procedures without disrupting live process safety.
3. Map ATT&CK v20 T1701 and T0869 behaviors to available workstation, gateway, network, and controller telemetry. Tune and test detections against approved engineering, vendor, backup, and maintenance activity before production alerting; monitor IT-to-OT boundary discovery and unusual authentication attempts.
4. Exercise an incident scenario involving lost PLC view/control and attempted IT-to-OT movement. Validate escalation paths, safe isolation options, clean-backup recovery, cellular remote-access logging, and coordination among operations, engineering, IT, and incident responders.

Sources

• 19 Updates — ATT&CK v20 (October 2026) — October 13, 2026. Official release start, campaign additions, ICS execution/C2 coverage, and platform/asset context in Detection Strategies.
• 20 ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage — MITRE ATT&CK — October 14, 2026. Six T1701 sub-techniques, T0869 additions, deprecations, and 15 new Detection Strategies with 38 Analytics, including 22 new ICS Analytics.
• 21 C0066: 2026 U.S. Water Utilities Attacks — MITRE ATT&CK — October 13, 2026 (v20 release; campaign included in v20). More than 30 Minnesota utilities, exposed PLCs, password/IP changes, operational effects, and the no-formal-attribution caveat.
• 22 Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions — FBI/EPA — July 30, 2026. Incidents in at least seven states since July 27, MicroLogix 1100/1400 exposure, operational effects, and recommendations; no asserted attribution.
• 23 CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs — July 30, 2026. Confirmed exposed-PLC targeting and recommended isolation, secure remote access, allowlisting, and clean backups.
• 24 C0064: AI-Assisted Breach of Mexico’s Government Infrastructure — MITRE ATT&CK — October 13, 2026 (v20 release; campaign included in v20). Cross-domain activity affecting Mexican government organizations including SADM Monterrey; mapping is not comprehensive.
• 25 The AI-Assisted Breach of Mexico’s Government Infrastructure — Gambit Security — April 10, 2026. Government IT compromise, SADM procurement/vendor records, and reported AI-tool use.
• 26 AI-Assisted ICS Attack on a Water Utility — Dragos — May 6, 2026. OT-adjacent gateway identified, unsuccessful password spraying, no observed OT breach, and unknown actor.
• 27 MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques — Industrial Cyber — October 16, 2026. Reporting summarizing the v20 campaign, technique, and Detection Strategy updates; the Mexico implication is qualified above against Dragos’s investigation.

5. n0n extortion claims target 38 global maritime and logistics organizations, raising port data exposure concerns

News briefing

SOCRadar reported that the extortion group n0n added 38 maritime, shipping, port-IT, and logistics organizations in 18 countries to its leak site in a batch posted October 12, 2026. The listings claim publication by October 19, 2026 at 13:27 UTC; SOCRadar says reviewed demands ranged from $2.4 million to $14 million. Reported record types include EDI messages, manifests, vessel schedules, gate movements, and terminal-system configuration material. These are extortion-group claims, not independently verified proof of theft or compromise. 28

SOCRadar observed recurring, narrowly scoped data descriptions and a lack of matching infostealer credentials for many named organizations, and suggested a shared application or vulnerability could explain the pattern. That is an analytical hypothesis only: neither an entry point nor a specific product has been confirmed. At reporting time, no listed maritime organization had publicly confirmed an incident. The accessible reports identify no CVE, CVSS score, affected/fixed version, or confirmed exploitation relationship. 28 30

The Loadstar independently corroborates the reported 38 listings and October 19 deadline, while also cautioning that the claims remain unverified. It reports that SOCRadar found no evidence connecting n0n to MOVEit or Cleo campaigns. The deadline remained in the future as of the October 16 cutoff. 29

What to do

1. Map where EDI, manifests, and terminal data flow—including port community systems, integration hubs, file-transfer services, and vendors—and ask providers whether they are investigating. Preserve relevant logs and validate incident contacts and reporting paths.
2. Review exposed interfaces, bulk downloads, remote access, and integration-account activity. Apply MFA, remove unnecessary internet-facing access, and rotate shared or long-lived SFTP/AS2/VAN/vendor credentials through approved change control; validate dependencies and rollback before production changes.
3. Check vendor advisories and asset inventories for applicable updates. Test changes in a representative non-production environment, coordinate with terminal and safety owners, and schedule any production patching or configuration change in an approved maintenance window with rollback and operational-impact checks.
4. Assess counterparty exposure: identify EDI partners whose records may be in a disclosed dataset, prepare a measured customer/regulator communications process, and monitor the alleged deadline and provider notifications without treating a listing alone as confirmed compromise.

Sources

• 28 n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site — SOCRadar — Published October 13, 2026 (page metadata); describes listings posted October 12, 2026. Original reporting on 38 organizations in 18 countries, the claimed October 19 deadline, reported data/demand details, and the explicit no-confirmation caveat; shared-application/vulnerability is an inference.
• 29 Cyber-crime group hits 38 shipping and port groups with date leak threat — The Loadstar — October 14, 2026. Independent logistics-sector corroboration of listings/deadline, possible shared-system exposure, no public confirmation, and no evidence tying n0n to MOVEit or Cleo campaigns.
• 30 n0n extortion claims target 38 global maritime and logistics organizations, raising port data exposure concerns — Industrial Cyber — October 15, 2026. Reporting reporting the SOCRadar account, data categories, deadline, possible shared access path, and lack of public confirmation.