Daily OT Security News — October 21, 2026
This public briefing covers five source-verified developments relevant to operational technology. Source dates are shown with each item. The Siemens item confirms active exploitation of a software-center flaw; the other items are vulnerability disclosures or controlled research findings and should not be read as confirmed compromise of production OT systems.
1. Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Source dates
Siemens advisory: October 15, updated October 17 and October 19, 2026. Siemens active-exploitation notice and SecurityWeek coverage: October 19. Help Net Security: October 20. Forescout ROMULUS research: October 15 in search results.
News briefing
Siemens validated active exploitation of CVE-2026-110936 in Siemens Software Center. The activity used a genuine, validly signed Siemens Software Center executable alongside attacker-supplied DLL files in a malicious installer distributed outside official Siemens channels. The vulnerable software then loaded the supplied DLLs. Siemens stated that it had no knowledge of a breach of its own systems, products, or update channel.
The affected product is Siemens Software Center, not a Siemens PLC. All versions earlier than 4.0.9.8 are affected; Siemens directs customers to update to 4.0.9.8 or later, and says existing installations update at next startup. The flaw is an uncontrolled DLL search-path issue, CWE-427, scored CVSS v4.0 8.4 and CVSS v3.1 6.7. Its vectors describe a local flaw requiring high privileges, so it should not be characterized as remote, unauthenticated exploitation.
Siemens links the activity to the ROMULUS multi-platform ClickFix campaign. ClickFix is the social-engineering step that persuades a person to paste and run an attacker-provided command; it is distinct from the underlying vulnerability. Siemens listed 96.62.218[.]59, wizardexpensive[.]com, and 2.27.248[.]127 as indicators. At publication, Siemens said the first two were active and the distribution server was inactive. Forescout reported that the platform operator’s identity and common ownership of malware families were unknown. The reviewed sources do not establish a victim count or compromise of an OT production system.
What to do
Ask the asset owner and OT/security team whether Siemens Software Center is installed on Windows engineering, maintenance, or support workstations. Under approved change control, assess compatibility and backups, test as appropriate, then update affected systems from official Siemens sources and verify version 4.0.9.8 or later. Instruct users never to paste web-page commands into Run or PowerShell, including purported CAPTCHA checks.
Review endpoint and network telemetry for the listed indicators and for suspicious SiemensSoftwareCenter.exe processes launched by msiexec from AppData\Local\Programs. Verify current indicator status before blocking, and use OT-approved firewall, DNS, or EDR changes to avoid operational disruption. If compromise is suspected, notify the control-system owner, preserve evidence, and isolate only under the approved OT containment plan.
Sources
- Siemens ProductCERT — Active Exploitation of CVE-2026-110936 in Siemens Software Center (October 19, 2026)
- Siemens ProductCERT — SSA-580366 (October 15; updated October 17 and October 19, 2026)
- Help Net Security — Attackers exploit Siemens Software Center vulnerability (October 20, 2026)
- SecurityWeek — Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks (October 19, 2026)
- Forescout Vedere Labs — ROMULUS delivery-platform analysis (October 15, 2026, search-result date)
2. Booz Allen warns frontier AI models can exploit OT pathways, manipulate controllers and move robotic equipment
Source dates
Industrial Cyber: October 20, 2026. SecurityWeek: October 14. Dark Reading: October 16. Booz Allen’s primary article was accessed October 21 and did not display a publication date.
News briefing
Industrial Cyber summarized Booz Allen research from an isolated, multi-vendor OT cybersecurity lab modeled on a manufacturing environment. Booz Allen says frontier models achieved each defined objective across eight controlled scenarios. In one test, models moved from a perimeter compromise to control-network actions in just over 16 minutes. In a separate test, a model identified and moved a robotic arm within minutes.
These are controlled lab results, not evidence of a production-system compromise or physical damage. Booz Allen says human operators approved every exploit and any action capable of producing a physical effect. Results at a facility would depend on its architecture, equipment, safeguards, and attacker access. The firm says models adapted when blocked; firewalls, segmentation, endpoint protection, and local-control settings slowed or stopped some actions, but no single safeguard consistently prevented objective completion across the evaluation.
The research supports concern about AI-assisted capability and compressed response time. It does not identify a CVE, affected or fixed product version, CVSS score, or confirmed exploitation in the wild. A lab observation of a SCADA gateway with pre-authenticated sessions to 14 OT devices is a test-environment detail, not proof that deployed SCADA environments share that configuration. Booz Allen distinguishes the robotic-arm demonstration from the just-over-16-minute perimeter-to-control scenario.
What to do
Have the site OT owner, controls engineering, and safety leads review network zones, remote access, dual-homed hosts, shared services, and pre-authenticated sessions. Confirm privileged-access controls and monitor for controller mode or force changes, logic or configuration writes, SCADA project imports, and unexpected inter-zone paths. Maintain tested known-good controller, HMI/SCADA, and network backups, and rehearse recovery.
Do not run active scans, exploit tests, controller writes, or safety-setting changes on production equipment without explicit owner authorization, engineering and safety review, and an approved change window. Favor passive or otherwise validated low-impact checks.
Sources
- Booz Allen — Frontier SI Reaches OT Systems and Moves Physical Equipment (undated page, accessed October 21, 2026)
- Industrial Cyber — Booz Allen warns frontier AI models can exploit OT pathways (October 20, 2026)
- SecurityWeek — AI Agents Navigate Unfamiliar OT Systems (October 14, 2026)
- Dark Reading — AI Takes Control of Robotic Arm in 16 Minutes Flat (October 16, 2026)
3. HMS Networks PEAK-System PCAN Windows drivers
Source dates
CISA initially released ICSA-26-293-01 on October 20, 2026. PEAK-System’s version-history entry for 5.1.4 is dated October 19. Both are current for this October 21 briefing.
News briefing
CISA’s advisory covers HMS Networks PEAK-System Device Driver Setup versions 5.1.2.1151 and earlier, and PCAN Windows CAN device drivers versions 5.1.2 and earlier. It explicitly associates six CVEs with both product entries: CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322, and CVE-2026-105960. Successful exploitation could crash the Windows kernel. CISA lists a vendor CVSS v3 score of 7.1.
PEAK-System’s official history says release 5.1.4, dated October 19, fixes several security vulnerabilities in PCAN-LAN, PCAN-Virtual, and PCAN-USB drivers that a local application could trigger, and strongly recommends updating. CISA’s search-indexed advisory text identifies 5.1.4 as the addressed version, although the fetched advisory body did not expose that remediation line.
CISA says these flaws are not remotely exploitable and, at publication, it had received no reports of known public exploitation specifically targeting them. This is a vulnerability disclosure, not confirmation of an attack or incident. One CISA page discrepancy remains: its summary says “5 Vulnerabilities” and lists five weakness categories, while six CVE identifiers are explicitly listed. This briefing uses the six-CVE list.
What to do
Identify Windows hosts that use PEAK-System/PCAN drivers through approved asset inventory and local version checks. Prioritize affected engineering, test, diagnostic, and other production-support endpoints. Have the responsible system owner and change authority assess compatibility and operational impact, test the fixed 5.1.4-or-later release on a representative non-production system, then deploy through the normal maintenance process with rollback planning.
Do not update a live control-support workstation without owner approval and a safe maintenance window. If patching is deferred, restrict local logon and software execution to authorized users, keep the host off internet-facing paths, and maintain appropriate network segmentation. Network controls complement patching and local access control; they do not remove the local attack path.
Sources
- CISA — ICSA-26-293-01: HMS Networks PEAK-System PCAN Windows drivers (initial release October 20, 2026)
- PEAK-System — CAN CC, CAN FD, CAN XL Device Driver 5.x Version History (version 5.1.4 entry, October 19, 2026)
- CISA — Releases Six Industrial Control Systems Advisories (October 20, 2026)
- PEAK-System — Cybersecurity Information and Reporting (consulted October 21, 2026)
4. WAGO OS Linux — CISA ICSA-26-293-02
Source dates
CISA initially released ICSA-26-293-02 on October 20, 2026. A secondary technical write-up is dated October 21. The CISA KEV feed snapshot reviewed was version 2026.10.16, released October 16, before this disclosure.
News briefing
CISA’s October 20 advisory covers two vulnerabilities in the web-based management interface of WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 devices. The affected range is WAGO OS Linux firmware 1.0.0 to below 4.10.0, including listed hardware families and “(70)” firmware variants. CISA says the bulletin is a verbatim republication of WAGO’s VDE-2026-096 advisory.
CVE-2026-80466 is OS command injection, scored CVSS 3.1 8.8 High and CVSS 4.0 8.7 High. It could allow an authenticated, low-privileged user to execute commands as root. CVE-2026-88850 is missing authorization, scored CVSS 3.1 8.1 High and CVSS 4.0 7.2 High. It could allow such a user to modify protected PROFIBUS parameters. The remediation is firmware 4.10.0 (FW32) or later; WAGO says customers using custom firmware should contact support.
The advisory describes potential vulnerability consequences, not observed attacks. It does not report known exploitation or an incident. The reviewed KEV snapshot predates disclosure, so its contents cannot establish exploitation status after October 20.
What to do
With the OT asset owner and controls engineer, inventory WAGO controller and panel models and firmware versions, identify devices below 4.10.0, and confirm the applicable image and upgrade procedure with WAGO. Until an approved update window, review web-based-management exposure and restrict management access to authorized engineering paths using site-approved firewall or routing changes. Do not disrupt or scan live OT equipment without authorization and impact review.
Baseline relevant PROFIBUS settings, bench-test the update against the application, then deploy during an owner-approved maintenance window with rollback and operational monitoring plans. Keep internet access blocked and remote access tightly controlled; use current VPN infrastructure only after assessing connected-endpoint risk.
Sources
- CISA — ICSA-26-293-02: WAGO OS Linux (initial release October 20, 2026)
- Trout Software — WAGO PFC200 and CC100 Command Injection (October 21, 2026)
- CISA — Known Exploited Vulnerabilities JSON feed (catalog version 2026.10.16)
5. Moxa AIG-302 ThingsPro Edge: two vulnerabilities affect firmware through 1.4.0
Source dates
CISA initially released ICSA-26-293-03 on October 20, 2026. Moxa advisory MPSA-262560 version 1.0 is dated October 16. JVN’s index was published and updated October 21.
News briefing
CISA confirms that Moxa AIG-302 ThingsPro Edge firmware 1.4.0 and earlier is affected by CVE-2026-109812 and CVE-2026-109813. Moxa describes CVE-2026-109812 as missing authorization on an internal secrets API. A low-privileged authenticated attacker with adjacent network access could access sensitive information, including key material. CVE-2026-109813 involves a shared hard-coded root CA private key; Moxa says an unauthenticated attacker with adjacent network access could compromise communications confidentiality and integrity. CISA describes the potential impact as disclosure of sensitive information.
Moxa identifies patch 1.4.1 as the fix. CISA lists CVSS v3 8.1 at advisory level. Moxa assigns individual CVSS v4 scores of 6.9 Medium for CVE-2026-109812 and 8.6 High for CVE-2026-109813. Because these use different CVSS versions and aggregation, the numbers are not directly comparable.
CISA says the vulnerabilities are not remotely exploitable and that it had received no reports of known public exploitation specifically targeting them at publication. That time-bounded statement does not establish the absence of private or otherwise unobserved exploitation. The sources describe vulnerabilities, not a confirmed incident.
What to do
Inventory AIG-302 ThingsPro Edge assets and verify firmware versions. Keep devices off the public internet and restrict adjacent network paths through owner-approved firewall, ACL, and segmentation controls. Assess operational impact before changes, then test and schedule Moxa’s 1.4.1 patch through change control using the official vendor process, with backups and rollback planning.
If patching is deferred, use approved compensating access controls and monitor relevant device and network logs. Do not make unapproved live OT changes; CISA calls for impact analysis and risk assessment before deploying defensive measures.
Sources
- CISA — ICSA-26-293-03: Moxa AIG-302 ThingsPro Edge (initial release October 20, 2026)
- Moxa — MPSA-262560 (October 16, 2026; version 1.0)
- JVN — JVNVU#90998702: CISA ICS Advisory / ICS Medical Advisory (October 21, 2026)
