RuntimeRebel — #Critical Manufacturing

Rockwell RSLinx <4.50.00 RCE via CVE-2020-13573 — Patch Now

Thu, 18 Jun 2026 09:58:04 GMT

Urgent advisory for Rockwell RSLinx Classic users. CVE-2020-13573, a stack-based buffer overflow, enables remote code execution and DoS. Patch <=4.50.00.

CVE-2026-11317: Rockwell Logix DoS via CIP — Patch Critical ICS

Thu, 18 Jun 2026 09:57:33 GMT

Critical Manufacturing faces high-severity DoS risk in Rockwell Automation Logix 5370 & 5570 controllers from CVE-2026-11317. Patch now.

CVE-2021-22291: ABB EIBPORT V3 <3.9.2 Session Hijacking Vulnerability

Thu, 28 May 2026 17:27:09 GMT

ABB EIBPORT V3 devices are vulnerable to CVE-2021-22291 (XSS/session hijacking), allowing unauthenticated access and configuration changes. Patch immediately.

CVE-2022-4304: Hitachi Energy GMS600 Timing Side Channel Vulnerability

Thu, 21 May 2026 20:43:48 GMT

Hitachi Energy GMS600 versions 1.3.0-1.3.1 affected by CVE-2022-4304, an OpenSSL timing side channel leading to TLS decryption. Patch to 1.3.2 now.

CVE-2026-0300: Siemens RUGGEDCOM APE1808 RCE via PAN-OS Vulnerability

Tue, 19 May 2026 20:43:35 GMT

Critical RCE (CVE-2026-0300) in Siemens RUGGEDCOM APE1808 devices via PAN-OS User-ID Captive Portal buffer overflow. Unauthenticated root code execution possible.

CVE-2026-40175: Siemens gWAP RCE via Axios Prototype Pollution

Thu, 14 May 2026 20:40:58 GMT

Siemens gWAP is vulnerable to RCE via CVE-2026-40175, a prototype pollution flaw in the Axios HTTP client library. Update to v3.1.1 or later.

CVE-2026-41551: Siemens ROS# Path Traversal Remediation Guide

Thu, 14 May 2026 20:40:37 GMT

Critical path traversal vulnerability (CVE-2026-41551) in Siemens ROS# file_server allows arbitrary file access. Immediate update to v2.2.2+ is crucial.

CVE-2025-15467: ABB AC500 V3 Stack Buffer Overflow to RCE

Tue, 12 May 2026 20:40:45 GMT

Critical vulnerability [CVE-2025-15467](https://nvd.nist.gov/vuln/detail/CVE-2025-15467) in ABB AC500 V3 PM5xxx firmware could lead to unauthenticated remote code…

ABB B&R Automation Runtime DoS via CVE-2025-11044 — Patch Now

Wed, 06 May 2026 00:49:26 GMT

An unauthenticated network DoS vulnerability (CVE-2025-11044) affects ABB B&R Automation Runtime, allowing permanent system halts. Immediate patching is critical.

CVE-2025-11043: ABB Automation Studio <6.5 Improper Certificate Validation

Wed, 06 May 2026 00:48:57 GMT

Critical manufacturing systems running ABB B&R Automation Studio <6.5 are vulnerable to CVE-2025-11043, allowing data interception and spoofing via improper certificate…

CVE-2026-3893: Unauthenticated Access in Carlson VASCO-B GNSS Receiver

Thu, 23 Apr 2026 20:26:34 GMT

Critical CVE-2026-3893 in Carlson VASCO-B GNSS Receivers <1.4.0 allows unauthenticated remote alteration of critical system functions. Update to v1.4.0+.

CVE-2026-5387: AVEVA Pipeline Simulation Privilege Escalation

Fri, 17 Apr 2026 05:05:22 GMT

Unauthenticated attackers can exploit CVE-2026-5387 in AVEVA Pipeline Simulation <=2025_SP1_build_7.1.9497.6351 to modify critical ICS simulation parameters and training…

Mitsubishi Electric ICS Vulnerabilities Expose SQL Credentials

Tue, 07 Apr 2026 16:31:20 GMT

High-severity vulnerabilities (CVE-2025-14815, CVE-2025-14816) in Mitsubishi Electric ICS/SCADA products risk SQL credential exposure and data compromise.

CVE-2026-4681: Critical RCE in PTC Windchill & FlexPLM

Thu, 26 Mar 2026 16:40:04 GMT

Critical RCE vulnerability CVE-2026-4681 affects PTC Windchill and FlexPLM via deserialization. Patch now to prevent code injection in critical manufacturing.

CVE-2026-3094: Delta CNCSoft-G2 Out-of-bounds Write RCE

Thu, 05 Mar 2026 20:17:47 GMT

Delta Electronics CNCSoft-G2 is vulnerable to an out-of-bounds write (CVE-2026-3094) allowing remote code execution. Update to V2.1.0.39.

Multiple DoS/RCE Vulnerabilities in Yokogawa CENTUM VP R6, R7

Thu, 26 Feb 2026 20:16:44 GMT

CISA alerts to multiple medium-severity vulnerabilities in Yokogawa CENTUM VP R6 and R7, allowing DoS and RCE via crafted packets in critical infrastructure…

Critical RCE Flaws in InSAT MasterSCADA BUK-TS Affect ICS

Wed, 25 Feb 2026 04:43:53 GMT

Two critical vulnerabilities (SQLi, OS Command Injection) in InSAT MasterSCADA BUK-TS lead to remote code execution, impacting critical infrastructure sectors globally.

Valmet DNA Engineering Web Tools Vulnerable to Path Traversal

Tue, 24 Feb 2026 12:25:56 GMT

Unauthenticated attackers can exploit CVE-2025-15577 in Valmet DNA Engineering Web Tools to gain arbitrary file read access across critical infrastructure.