These are the most significant OT, ICS, and IoT cybersecurity developments from the past day.
CISA republishes critical Siemens Industrial Edge Management account-takeover advisory
CISA republished Siemens advisory SSA-503852 for CVE-2026-18963 (CVSS 9.1), an authentication-bypass flaw in the Keycloak reset-credentials flow. An unauthenticated attacker can force a password reset without email verification and take over an account in affected Industrial Edge Management Cloud, Pro, and Virtual versions. Siemens provides fixed releases and advises blocking direct internet access or the affected reset path where immediate patching is not possible.
Source: CISA
CISA republishes critical Siemens Siveillance Control arbitrary-file-upload advisory
CISA republished Siemens advisory SSA-254516 for CVE-2026-50093 (CVSS 9.0), an arbitrary-file-upload flaw in the Open Interface Services web module used by affected Siveillance Control and Siveillance Control Pro releases. Exploitation can yield root-level access to the host and full compromise of the OIS environment. Siemens released product updates and recommends deployment in a protected IT environment.
Source: CISA
CISA republishes Siemens Desigo CC client-code-execution advisory with no fix available
CISA republished Siemens advisory SSA-330084 for CVE-2026-34223 (CVSS 8.2), a client-code-execution issue in Desigo CC family versions 6 and 7. A maliciously modified graphics document can execute embedded commands when displayed by a sufficiently privileged user, write arbitrary files to the client operating system, and enable lateral movement. No fix was available at publication; Siemens recommends least-privilege authorization for the Graphics application.
Source: CISA
CISA republishes Siemens SIMOVE Fleetmanager and SIPLANT path-traversal advisory
CISA republished Siemens advisory SSA-517424 for CVE-2026-67367 (CVSS 8.6), a path-traversal flaw in the embedded HTTP server of affected SIMOVE Fleetmanager and SIPLANT versions. An unauthenticated remote attacker may read arbitrary operating-system files, exposing credential stores, private keys, and configuration secrets. Siemens supplies updates and recommends restricting network access and services’ access rights to project files.
Source: CISA
CISA issues OpenPLC Runtime v3 advisory as the legacy platform reaches end of life
CISA published ICSA-26-265-09 for CVE-2026-88020 (CVSS 6.1), a cross-site-scripting vulnerability in OpenPLC Runtime v3. Exploitation could hijack an operator session and issue state-changing requests, allowing an attacker to control the PLC and its physical process. OpenPLC v3 is end-of-life, and the vendor recommends upgrading to v4; CISA reported no known public exploitation at publication.
Source: CISA
Operators should assess exposure and apply vendor/CISA guidance through their established change-control process.
