cyber.hendryadrian.com
Security News · securityweek.com

Schneider Electric, Siemens and Aveva Address ICS Vulnerabilities in September Patch Advisories

· Original article ↗

Summary

Schneider Electric, Siemens and Aveva issued September 2026 ICS security advisories covering critical and high-severity flaws. Siemens also began updating products for the Linux Copy Fail vulnerability; Rockwell Automation and CISA issued additional advisories.

Key points

  • Schneider Electric disclosed a critical authentication flaw, CVE-2026-3869 (CVSS 9.2), affecting Modicon M580 and M580 Safety controllers.
  • Siemens issued nine new advisories and updated nine others; four new advisories address critical flaws in Reyrolle 7SR5, OIS, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.
  • Siemens announced updates for several products to address the Linux kernel Copy Fail vulnerability, CVE-2026-31431 (CVSS 7.8), which can enable root shell access.
  • Aveva's Pipeline Integrity Monitor PIMBoards advisory covers four flaws, including a hardcoded encryption key and weak MD5 password hashing; it also warned of unsafe deserialization in Enterprise SCADA.
  • Rockwell Automation issued nine advisories covering critical- and high-severity flaws across multiple products, including RSLinx Classic and several controller families.
  • CISA published advisories for vulnerabilities in products from numerous vendors, including Johnson Controls, Hitachi Energy, and Inductive Automation.

Article Details

Event Type
Industrial control systems vendors published and updated security advisories and patches addressing vulnerabilities in their products.
Impact
The reported vulnerabilities affect products from Schneider Electric, Siemens, Aveva, and Rockwell Automation. Impacts described include critical authentication bypass, root shell access, decryption of sensitive information, potential recovery of administrative passwords, and possible remote code execution. The article does not report confirmed exploitation or a specific incident.

CVE

CVE-2026-31431Linux · Linux; Red Hat · NVIDIA for RHEL 10; +95 moreTracked as CVE-2026-31431 (CVSS score of 7.8), it allows attackers to achieve root shell access.CVE-2026-3869Vendor / Product unavailableTracked as CVE-2026-3869, the flaw has a CVSS score of 9.2.

Vendors

AvevaIndustrial giants Schneider Electric, Siemens, and Aveva have published September 2026 Patch Tuesday advisories, informing customers about vulnerabilities found in their ICS products.Rockwell AutomationLast week, Rockwell Automation published nine security advisories that cover critical- and high-severity flaws in RSLinx Classic and high-severity bugs in the 1756-ENBT module, FactoryTalk Historian Machine EditionSchneider ElectricIndustrial giants Schneider Electric, Siemens, and Aveva have published September 2026 Patch Tuesday advisories, informing customers about vulnerabilities found in their ICS products.SiemensIndustrial giants Schneider Electric, Siemens, and Aveva have published September 2026 Patch Tuesday advisories, informing customers about vulnerabilities found in their ICS products.

Products

1756-ENBT modulethat cover critical- and high-severity flaws in RSLinx Classic and high-severity bugs in the 1756-ENBT module, FactoryTalk Historian Machine Edition (ME), FactoryTalk Activation Manager, Redundancy ModuleArmorStart Distributed Motor ControllersFactoryTalk Activation Manager, Redundancy Module Configuration Tool, ControlFLASH, ArmorStart Distributed Motor Controllers, and the CompactLogix 5380/5480/5580, GuardLogix 5580, and Compact GuardLogix 5380Compact GuardLogix 5380Distributed Motor Controllers, and the CompactLogix 5380/5480/5580, GuardLogix 5580, and Compact GuardLogix 5380 controllers.CompactLogix 5380/5480/5580Module Configuration Tool, ControlFLASH, ArmorStart Distributed Motor Controllers, and the CompactLogix 5380/5480/5580, GuardLogix 5580, and Compact GuardLogix 5380 controllers.ControlFLASHHistorian Machine Edition (ME), FactoryTalk Activation Manager, Redundancy Module Configuration Tool, ControlFLASH, ArmorStart Distributed Motor Controllers, and the CompactLogix 5380/5480/5580, GuardLogix 5580, andDesigo CCThe remaining flaws are high-severity issues in Desigo CC, Teamcenter, Mendix SAML module, and Element Maps.EcoStruxure IT Data Center ExpertSchneider Electric also resolved high-severity bugs in the PowerLogic T300 platform (formerly Easergy T300 RTU) and its EcoStruxure IT Data Center Expert product, and a medium-severity defect in SCADAPack x70 products.Element MapsThe remaining flaws are high-severity issues in Desigo CC, Teamcenter, Mendix SAML module, and Element Maps.Enterprise SCADASince the previous Patch Tuesday, Aveva also warned of a medium-severity unsafe deserialization vulnerability in Enterprise SCADA that could potentially lead to remote code execution.FactoryTalk Activation Managerand high-severity bugs in the 1756-ENBT module, FactoryTalk Historian Machine Edition (ME), FactoryTalk Activation Manager, Redundancy Module Configuration Tool, ControlFLASH, ArmorStart Distributed MotorFactoryTalk Historian Machine Editionhigh-severity flaws in RSLinx Classic and high-severity bugs in the 1756-ENBT module, FactoryTalk Historian Machine Edition (ME), FactoryTalk Activation Manager, Redundancy Module Configuration Tool, ControlFLASH,GuardLogix 5580Tool, ControlFLASH, ArmorStart Distributed Motor Controllers, and the CompactLogix 5380/5480/5580, GuardLogix 5580, and Compact GuardLogix 5380 controllers.Industrial Edge ManagementFour of the newly released advisories cover critical-severity vulnerabilities in Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.Mendix SAML moduleThe remaining flaws are high-severity issues in Desigo CC, Teamcenter, Mendix SAML module, and Element Maps.Modicon M580The most severe of the newly addressed issues is a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers.Modicon M580 Safety controllersThe most severe of the newly addressed issues is a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers.Modicon MC80On Tuesday, the company also updated four security advisories that cover older security weaknesses to add mentions of patches being rolled out for the Modicon MC80 controller.Open Interface Services (OIS)Four of the newly released advisories cover critical-severity vulnerabilities in Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.PIMBoardsAveva on Tuesday published an advisory covering four flaws in the PIMBoards component of Pipeline Integrity Monitor.Pipeline Integrity MonitorAveva on Tuesday published an advisory covering four flaws in the PIMBoards component of Pipeline Integrity Monitor.PowerLogic T300Schneider Electric also resolved high-severity bugs in the PowerLogic T300 platform (formerly Easergy T300 RTU) and its EcoStruxure IT Data Center Expert product, and a medium-severity defect in SCADAPack x70 products.Redundancy Module Configuration Toolmodule, FactoryTalk Historian Machine Edition (ME), FactoryTalk Activation Manager, Redundancy Module Configuration Tool, ControlFLASH, ArmorStart Distributed Motor Controllers, and the CompactLogixReyrolle 7SR5Four of the newly released advisories cover critical-severity vulnerabilities in Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.RSLinx ClassicAutomation published nine security advisories that cover critical- and high-severity flaws in RSLinx Classic and high-severity bugs in the 1756-ENBT module, FactoryTalk Historian Machine Edition (ME),SCADAPack x70Schneider Electric also resolved high-severity bugs in the PowerLogic T300 platform (formerly Easergy T300 RTU) and its EcoStruxure IT Data Center Expert product, and a medium-severity defect in SCADAPack x70 products.SIMOVE FleetmanagerFour of the newly released advisories cover critical-severity vulnerabilities in Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.SIPLANTFour of the newly released advisories cover critical-severity vulnerabilities in Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.TeamcenterThe remaining flaws are high-severity issues in Desigo CC, Teamcenter, Mendix SAML module, and Element Maps.

Related Articles