Daily OT Security News: October 18, 2026

1. CISA warns of active exploitation of BeyondTrust Remote Support authentication bypass

Source date(s): October 16, 2026 (CISA alert).

News briefing

CISA said on October 16 that threat actors are actively exploiting CVE-2026-102764, a critical authentication-bypass vulnerability affecting self-hosted BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. CISA reports the activity is being used for initial access, persistence, privilege escalation and lateral movement, and added the CVE to its Known Exploited Vulnerabilities catalog that day. BeyondTrust describes the underlying flaw as improper origin validation in an internal messaging component that could permit remote file operations under the right conditions.

CISA urges operators of affected self-hosted appliances to apply BeyondTrust’s BT26-05-RS patch and limit external access, including restricting administrative interfaces to trusted networks. Self-hosted versions older than 24.3.1 must first be upgraded to a version eligible for the patch. BeyondTrust says its SaaS Remote Support customers were patched by October 9. The CISA alert calls for forensic investigation where compromise is suspected; the sources reviewed do not report a confirmed OT compromise.

For infrastructure operators, the immediate issue is exposure of a remote-support control point that may hold or inject credentials and enable privileged sessions—not evidence that an industrial process was compromised. Confirm deployment type and version, then coordinate remediation and service checks with the system owner; suspected compromise requires incident-response handling, not patching alone.

What to do

• Remote-support/service owner: inventory BeyondTrust Remote Support deployments, identify self-hosted instances and confirm versions and patch status; prioritize self-hosted versions 26.2.3 and earlier. Confirm SaaS status with the provider.
• Change owner with the service owner: apply BT26-05-RS following BeyondTrust’s advisory; upgrade versions older than 24.3.1 before patching. Use an approved maintenance window and validate user support sessions, integrations and logs after the change.
• Network/security owner: restrict external access to only required services and limit administrative interfaces to trusted networks, with owner approval. Validate that legitimate support workflows still function and review exposure logs.
• Incident-response lead, if compromise is suspected: follow CISA’s containment and evidence-preservation guidance, investigate appliance and perimeter/session logs, and coordinate rebuild, patching, credential rotation, session revocation and privileged MFA-registration review. Validate service restoration from a known-good state.

Sources

• CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support — 2026-10-16 (alert date, also in URL)
• BT26-05 — 2026-10-15 (issue date and updated date)
• CVE-2026-102764 — Date unavailable in the retrieved record (the page showed an unpopulated ‘Updated’ field)

2. CISA flags privilege-escalation flaw in Inductive Automation Ignition

Source date(s): October 13, 2026 (CISA lists this as the initial release date; its revision history also inconsistently shows September 13, 2026).

News briefing

CISA’s ICSA-26-286-01 advisory describes CVE-2026-92817 as an incorrect-authorization flaw in Inductive Automation Ignition: an authenticated low-level user could escalate privileges. CISA gives CVSS v3 8.8 and identifies affected versions as 8.1.0–8.1.54 and 8.3.0–8.3.8. It tags Critical Manufacturing, Energy and Information Technology as affected critical-infrastructure sectors. CISA’s page says no known public exploitation specifically targeting this vulnerability had been reported at publication; this is a vulnerability advisory, not a report of an incident.

Inductive Automation’s Trust Center recommends updating to Ignition 8.1.55 or 8.3.9 or newer. There is a material description discrepancy: that vendor page labels CVE-2026-92817 an authenticated remote-code-execution vulnerability, while CISA describes privilege escalation/incorrect authorization. Treat CISA’s advisory as the basis for this briefing’s impact description and confirm the exact issue and applicable upgrade path with the vendor before risk decisions. CISA’s displayed initial release date is October 13, but the same page’s revision history also contains a September 13 initial-publication entry; the page does not explain the mismatch.

What to do

• OT/SCADA asset owner and controls engineering: inventory Ignition Gateways and modules, verify installed versions against both affected ranges, and record business/process criticality and dependencies; confirm uncertain versions with Inductive Automation.
• System owner, OT change authority and vendor: plan and obtain approval for an upgrade to the vendor-recommended 8.1.55 or 8.3.9+ release appropriate to the deployment. Review compatibility, backups/rollback, redundancy and maintenance-window needs before making the change.
• Until upgrade, OT network/security owner: review Gateway exposure and restrict unnecessary internet/business-network reachability and remote access using approved firewall/segmentation controls. These measures reduce exposure but do not fix the flaw; assess operational impact first.
• After the approved upgrade, controls/application owners: validate Gateway and dependent project, module, authentication, communications and process-monitoring services; document the installed version, test results and any remaining exceptions. Escalate suspected malicious activity through established incident procedures; CISA reports no known public exploitation at advisory publication.

Sources

• Inductive Automation Ignition Software — ICSA-26-286-01 — Initial Release Date shown as 2026-10-13; revision history additionally shows 2026-09-13 as initial publication (inconsistent)
• Inductive Automation Trust Center — Date unavailable (undated page)

3. CISA advisory: Swann camera flaws could expose video without authentication

Source date(s): October 13, 2026 (CISA advisory initial release).

News briefing

CISA’s October 13 advisory identifies three vulnerabilities—CVE-2026-107605, CVE-2026-107606, and CVE-2026-107607—in Swann Communications SWIFI-SE2KIC cameras running firmware 2.0.22 or earlier. CISA says successful exploitation could allow video information to be viewed without authentication and associates the device with the Commercial Facilities sector. These are potential vulnerabilities, not a reported incident.

CISA says the flaws are not remotely exploitable and that it had received no reports of known public exploitation specifically targeting them at the time of the advisory. The advisory’s revision history lists only its October 13 initial release; it does not identify a fixed firmware version. Organizations should verify their own device/model and firmware status and seek vendor guidance rather than assume a particular upgrade resolves the issue.

What to do

• Have asset and physical-security owners inventory SWIFI-SE2KIC cameras and verify firmware versions against the advisory; document locations, network paths, and business/service criticality.
• Review exposure and restrict camera access to only required systems. Following CISA guidance, ensure devices are not internet-accessible, use owner-approved firewall controls, and isolate relevant device networks from business networks where feasible; assess operational impact before changes.
• Ask Swann for current remediation and supported-firmware guidance. Do not assume an unverified release fixes the issue; stage any owner-approved change and validate live video, recording, retention, and dependent services afterward.
• If remote access is needed, review the approved access path and maintain current VPN software, as CISA recommends; verify that the connected camera and surrounding systems remain appropriately protected.

Sources

• Swann Communications SWIFI-SE2KIC (CISA ICS Advisory ICSA-26-286-02) — Initial release 2026-10-13; no later revision listed (read 2026-10-18)

4. CISA warns of serious J4Care dcm4che risks to medical-image systems

Source date(s): October 15, 2026 (CISA initial release; Revision 1 was the initial publication on the same date).

News briefing

CISA’s October 15 medical advisory identifies dcm4chee-arc-light 5.35.1, a J4Care dcm4che medical-imaging archive, as affected by six CVEs: CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279 and CVE-2026-105667. CISA assigns the group a Vendor Equipment CVSS v3 score of 9.1 and lists four vulnerability classes: missing authorization, missing authentication for a critical function, an infinite loop and inefficient algorithmic complexity.

CISA says successful exploitation could delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files or cause denial of service—risks to healthcare and public-health operations. These are potential impacts, not a report of an incident: CISA says it knows of no public exploitation specifically targeting these vulnerabilities. Its advisory recommends minimizing network exposure, using firewalls and isolating control-system networks from business networks, securing remote access and assessing operational impacts before changes. The advisory does not name a fixed software version.

What to do

• PACS/application owner, with clinical engineering and security: inventory dcm4chee deployments and confirm product/version against 5.35.1; review internet exposure, trust boundaries and remote-access paths. Record findings and prioritize exposed or clinically critical instances.
• Network/security owner: following change control and an impact assessment, restrict unnecessary access to the archive, place it behind appropriate firewalls and separate it from business networks; use secure, current remote-access methods where required. Validate authorized DICOM workflows, user access and clinical connectivity after each change.
• PACS owner: ask J4Care/vendor support for remediation guidance and a supported fixed release; do not infer an upgrade target from this advisory. When vendor guidance is available, test and schedule any owner-approved update or mitigation, then validate image ingest, retrieval, records and service availability.
• Healthcare operations and security: confirm recoverable backups and image/record integrity procedures, and monitor service availability and unexpected changes to studies or records. Escalate suspected malicious activity under established incident procedures; do not treat the advisory itself as evidence of compromise.

Sources

• J4Care dcm4che — CISA ICS Medical Advisory ICSMA-26-288-02 — Initial release October 15, 2026; Revision 1 initial publication October 15, 2026

5. CISA reports path-traversal file-read flaw in Thermo Fisher Torrent Suite

Source date(s): October 15, 2026 (CISA medical advisory initial release).

News briefing

CISA’s October 15 medical advisory identifies a path-traversal vulnerability, CVE-2026-107777, affecting Thermo Fisher Torrent Suite Software version 5.18 and earlier. CISA says successful exploitation could allow an attacker to read arbitrary files on the Torrent Server. It identifies Healthcare and Public Health as the affected critical-infrastructure sector and says the product is deployed worldwide.

CISA reported no known public exploitation specifically targeting this vulnerability at the time of the advisory. This is a reported vulnerability, not a report of an incident; the advisory does not establish that a customer environment has been compromised. The advisory page reviewed does not identify a fixed release, so confirm remediation guidance with Thermo Fisher rather than assuming an upgrade version.

CISA recommends minimizing internet exposure, placing control-system networks and remote devices behind firewalls and isolating them from business networks, and using secure, maintained methods such as VPNs when remote access is required. Apply changes only after an impact/risk review: Torrent Server availability may matter to laboratory workflows, and CISA explicitly advises proper impact analysis before defensive measures.

What to do

• Laboratory IT and the application owner should inventory Torrent Suite installations, confirm versions and network exposure, and identify dependencies and accountable system owners; coordinate findings with the organization’s security team.
• The system owner should consult Thermo Fisher for verified remediation or compensating-control guidance and an approved maintenance plan; do not deploy an unverified package or infer a fixed version from the advisory.
• With laboratory/clinical operations approval, network engineering should review internet exposure, firewall rules, business-network isolation, and remote-access paths against CISA’s recommendations. Document rollback steps and assess whether controls could disrupt required workflows.
• After any approved change, the application owner and laboratory operations should validate Torrent Server access, required sequencing/lab workflows, and relevant logging/monitoring; escalate suspicious activity under incident-response procedures and report suspected malicious activity through established channels.

Sources

• Thermo Fisher Torrent Suite Software — CISA ICS Medical Advisory ICSMA-26-288-01 — Initial release October 15, 2026; revision history says Revision 1, Initial Publication, October 15, 2026