Updated just now · 118 advisories
An attacker with engineering workstation credentials could tamper with serialized data sent to AVEVA Enterprise SCADA servers, leading to arbitrary code execution and potential control of industrial processes including shutdowns or unsafe setpoint changes.
An attacker could run commands with root-level access on your HMI gateway, potentially allowing them to modify process parameters, stop production systems, or compromise other connected industrial devices on your network.
An attacker with local access to an Airwall device could decrypt sensitive data and bypass authentication controls, potentially reading arbitrary files or accessing protected system resources.
An attacker on the local network could read sensitive data from the HIPASE-250 device or compromise connected engineering workstations, potentially exposing control system configuration or process parameters.
An attacker with low-privilege access could inject malicious code into Metasys that runs in other users' sessions, including administrators, potentially allowing them to hijack accounts and gain unauthorized control of building automation systems.
An attacker within Bluetooth range could manipulate brain stimulation settings and bypass safety limits on the FL-100 device, potentially causing harmful electrical stimulation or device malfunction.
This is an advance notification only; no vulnerabilities have been disclosed yet. Cisco will publish security advisories on August 19, 2026 for multiple products including firewalls, contact center systems, network switches, and collaboration platforms. Impact will be determined when the full advisories are released.
An attacker without authentication could run commands on PLCnext controllers, disrupt operations through denial of service, or bypass access controls—affecting production lines, water treatment processes, or power distribution automation. Integrity and confidentiality of control logic and operational data are at risk.
An attacker with network access to FortiManager could bypass authentication and issue commands that make it accept unauthorized Fortinet devices, allowing the attacker to masquerade as a trusted firewall and intercept or redirect traffic destined for your protected networks.
An attacker can send specially crafted HTTP/2 requests to cause a denial of service, making the affected gateway or access control device unavailable and disrupting network traffic or administrative access to critical systems.
An authenticated admin on FortiSIEM could use the vulnerability to make unauthorized requests to internal systems and cloud services that the FortiSIEM server can reach, potentially accessing sensitive data or triggering unintended actions on those systems.
An attacker could overflow a buffer in the WAD (Web Application Delivery) service to crash the FortiGate appliance or potentially execute arbitrary code, disrupting network connectivity and security services for your facility.
An attacker can send specially crafted network requests to cause the FortiGate web management interface to become unresponsive, preventing administrators from accessing the firewall's configuration and monitoring capabilities.
An attacker positioned on the network between a user and the VPN gateway could intercept and modify GlobalProtect app communications, potentially stealing credentials or session tokens used for authentication. VPN tunnel traffic itself remains encrypted and is not affected.
A locally authenticated user on a macOS system running the GlobalProtect client could exploit a race condition to gain root-level access, allowing them to modify VPN configuration, intercept traffic, or compromise the entire endpoint.
A local user on a Windows or macOS endpoint running the Prisma Access Agent could escalate their privileges and run arbitrary code with admin rights, potentially compromising the entire endpoint and gaining access to network resources your VPN protects.
An attacker with administrator-level access to a Windows computer running Prisma Access Agent could bypass security protections and gain unauthorized access to the agent's processes and data, potentially compromising the security of the endpoint and any connected industrial networks.
A local administrator on a Windows machine running Prisma Access Agent could bypass network security inspection, allowing them to inject malicious traffic or intercept sensitive data that should be protected by the agent.
A local user with basic access to a Linux machine running Prisma Access Agent could delete specific system files and disable the VPN agent, potentially disrupting secure remote access for the organization.
An attacker on your network can read sensitive information from URL filtering response pages without authentication, potentially exposing system details or internal data. This affects your network perimeter security posture but does not directly impact process control systems.
A user with regular (non-administrator) access to a Windows, macOS, or Linux workstation running GlobalProtect could escalate their privileges to full administrative control, allowing them to install malware, modify system settings, or access sensitive data on that device.
An attacker on the network path between a Windows computer and GlobalProtect gateway could run code with system privileges during user logon, potentially installing malware, stealing credentials, or disrupting VPN authentication before the user logs in.
An attacker positioned between a user and the VPN gateway during the UDP tunnel handshake could crash the GlobalProtect app or potentially execute code with system-level privileges, disrupting remote access and potentially compromising the endpoint.
An attacker on the network can force your firewall to reboot by sending a specially crafted request to the SSL VPN service, taking your firewall offline and blocking all traffic until it restarts. This directly interrupts network and operational access for your facility.
An attacker could trigger a buffer over-read in the SMB client to read sensitive data from system memory. While the direct risk to OT operations is limited, this could expose credentials or configuration details used by HMI systems and engineering workstations.
An attacker with valid domain credentials could bypass Active Directory security controls by exploiting weak encryption, potentially allowing unauthorized access to network resources or accounts they should not have permission to access.
An attacker with a local user account could gain system-level access to Windows servers or workstations, potentially allowing them to modify control logic, disable monitoring, or compromise the entire system.
An attacker with local access to a Windows workstation or server could exploit this flaw to gain system-level privileges, allowing them to install malware, modify control systems software, or disrupt operations.
An attacker with a valid user account on a Windows machine could gain full administrative control of that system, allowing them to install malware, modify critical files, or disrupt operations.
An attacker with local access to a Windows system can read sensitive data from NTFS filesystem memory that should not be accessible, such as file content or system information.
A user with local access to a Windows computer or server could exploit this buffer overflow vulnerability to gain administrative privileges and take full control of the system. In an OT environment, this means an attacker with physical or local network access could modify control logic, disable safety systems, or shut down critical processes.
A local user with standard privileges could read sensitive kernel memory and escalate to administrator access on Windows systems running NTFS. This could allow an attacker to gain full control of a supervisory or engineering workstation.
An attacker who tricks a user into connecting to a malicious Remote Desktop server could execute code on the victim's machine with the user's privileges, potentially gaining control of engineering workstations or server systems.
An attacker on your network could send a specially crafted DHCP request to a Windows DHCP server to gain control and run arbitrary code on it. If your DHCP server manages network configuration for critical operational devices, this could disrupt network access to PLCs, RTUs, or other control systems.
An attacker on your network could trigger a bug in the Windows DHCP Server that causes it to reveal sensitive network information, such as DHCP lease details or configuration data, without needing to authenticate.
A local user with standard privileges on a Windows server running DHCP could exploit a file link-following flaw to gain administrative rights, potentially allowing them to modify DHCP configurations, redirect network traffic, or disrupt IP address assignment across your facility network.
An attacker with local access to a Windows server running DHCP could exploit a link-following flaw to escalate privileges to system level, potentially gaining control of the entire server and the DHCP services that manage your network device assignments.
An attacker with physical access to a Windows system could read sensitive data from NTFS file system memory, potentially exposing confidential files or system information stored on disk.
A user with local access to a Windows computer could exploit a use-after-free flaw in the DHCP client to run arbitrary code with elevated privileges, potentially compromising the system and any connected networks or operational systems it manages.
A remote attacker could execute arbitrary code on any Windows workstation or server running the affected Remote Desktop Client, allowing unauthorized control of engineering workstations, SCADA servers, or other critical IT infrastructure supporting OT operations.
An attacker on the network can send specially crafted TCP/IP packets to crash the TCP/IP stack, causing the affected Windows system to stop responding to network traffic. This could disrupt any critical process relying on network connectivity, including remote access to PLCs, HMI systems, or data historian servers.
An attacker could execute arbitrary code on a Windows domain controller or domain-joined machine through Active Directory, potentially compromising domain accounts, modifying security policies, or disrupting authentication services that critical OT systems rely on.
An attacker on an adjacent network (same subnet) could trigger an integer underflow in Windows DHCP Server to extract sensitive information from memory, such as configuration details, credentials, or other system data.
An attacker with a standard user account on a Windows system could run commands with administrator privileges, allowing them to modify system settings, install software, alter critical configurations, or disable security controls on HMI workstations or engineering computers in your facility.
An attacker with a local user account on a Windows system running Remote Desktop Services could execute arbitrary code with system privileges, gaining full control of the machine and any processes or data on it.
An attacker with a local user account on a Windows computer or server could exploit this buffer overflow to gain administrator or system-level privileges, potentially allowing them to install malware, modify critical files, or disrupt operations on systems running SCADA or ICS software.
An attacker could craft a malicious RDP server response that causes an out-of-bounds read in the Windows Remote Desktop Client, exposing sensitive information such as memory contents from the client machine. This could leak credentials, encryption keys, or other confidential data.
An attacker with local access and user-level credentials on a Windows system running Hyper-V could extract sensitive information from system memory, potentially exposing configuration details or data from running virtual machines.
An attacker with a local user account on a Windows server running Remote Desktop Services could elevate their privileges to administrator level, allowing them to control the entire system and any industrial processes running on it.
A user with local access to a Windows system running RDS could escalate their privileges to SYSTEM, potentially gaining control over that computer and any connected OT devices or industrial control systems it manages.