Industrial giants Schneider Electric, Siemens and AVEVA have published their September 2026 Patch Tuesday advisories, informing customers about vulnerabilities affecting their ICS products.
Schneider Electric published four new security advisories and updated four others, including one originally released in 2019.
The most severe of the newly addressed issues is a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers. Tracked as CVE-2026-3869, the flaw has a CVSS score of 9.2.
Schneider Electric also resolved high-severity vulnerabilities in the PowerLogic T300 platform, formerly known as the Easergy T300 RTU, and its EcoStruxure IT Data Center Expert product, as well as a medium-severity flaw affecting SCADAPack x70 products.
The company also updated four advisories covering older vulnerabilities to note the availability of patches for the Modicon MC80 controller.
Siemens has published nine new advisories since the previous Patch Tuesday, including seven released on September 8, and updated nine others.
Four of the new advisories cover critical-severity vulnerabilities affecting Reyrolle 7SR5, Open Interface Services (OIS), Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT.
The remaining advisories address high-severity vulnerabilities in Desigo CC, Teamcenter, the Mendix SAML module, and Element Maps.
Siemens also announced updates for several products affected by the Copy Fail Linux kernel vulnerability disclosed in April. Tracked as CVE-2026-31431 and carrying a CVSS score of 7.8, the flaw can allow attackers to obtain root shell access.
AVEVA published an advisory on Tuesday covering four vulnerabilities in the PIMBoards component of Pipeline Integrity Monitor.
Two are high-severity flaws: one involves a hardcoded encryption key that could allow attackers to decrypt sensitive information, while the other involves the use of MD5 for password hashing, potentially enabling attackers to recover administrative passwords.
Since the previous Patch Tuesday, AVEVA has also warned customers about a medium-severity unsafe deserialization vulnerability in Enterprise SCADA that could potentially lead to remote code execution.
Last week, Rockwell Automation published nine advisories covering critical- and high-severity vulnerabilities in RSLinx Classic, as well as high-severity flaws affecting the 1756-ENBT module, FactoryTalk Historian Machine Edition (ME), FactoryTalk Activation Manager, Redundancy Module Configuration Tool, ControlFLASH, ArmorStart Distributed Motor Controllers, and CompactLogix 5380, 5480 and 5580, GuardLogix 5580, and Compact GuardLogix 5380 controllers.
Since the previous Patch Tuesday, CISA has published advisories covering vulnerabilities in products from CareCam, Tycon Systems, Pyramid Solutions, Inductive Automation, IXON, OPC Foundation, Ebyte, All-Line Equipment Company, Applied Systems Engineering, Xiiaozet, Furuno, Bendix, PayRange, Rently, Johnson Controls, Flow Neuroscience, Andritz, Hitachi Energy, Haiwell, Pulsetto Vagus, and Mira Hormone.
ICS Patch Tuesday September 2026: Vulnerabilities Fixed by Schneider Electric, Siemens, Aveva
Critical vulnerabilities in Schneider Electric and Siemens products could enable unauthorized access, remote code execution and complete system compromise.
Volt Typhoon Hackers Dwelled in US Electric for 300+ Days: Report
Dragos shared some details describing an intrusion attributed to the notorious Chinese threat actor Volt Typhoon into the US electric grid.
ICS Patch Tuesday September 2024: Advisories Published by ABB, Siemens, Schneider, CISA
For September 2024, two dozen ICS Patch Tuesday advisories were published by Siemens, Schneider Electric, CISA and ABB.
Russian Sandworm Hackers Target Ukraine’s Power Grid in Coordinated Cyber-Physical Attack
Russia’s Sandworm hackers disrupted power in Ukraine using a novel attack against operational technology (OT) coordinated with missile strikes.
Rockwell Automation to Acquire ICS/OT Security Firm Verve Industrial
Industrial giant Rockwell Automation announced on Monday that it has signed a definitive agreement to acquire Verve Industrial Protection, a cybersecurity company specializing in industrial control systems (ICS) and operational technology (OT). Verve’s managed OT/ICS security platform provides asset inventory, vulnerability management, patch management, configuration management, SIEM, incident response, and backup and restore capabilities. In addition, the company provides network segmentation, vulnerability assessment, system hardening, automation engineering, and consulting services. The deal enables Rockwell Automation to expand and strengthen its offering. Financial details have
Radiflow, Cyolo Team Up to Secure OT Networks Against Unauthorized Devices
Radiflow and Cyolo partnership will allow organizations implement a seamless, single sign-on experience for remote and third-party vendors, while significantly enhancing network security.
CISA Announces Free Vulnerability Scanning for Water Utilities
CISA announced a new vulnerability scanning service designed to help water utilities identify and address security holes that could expose their systems to remote attacks.
Yokogawa to Sell Unidirectional Gateways from Waterfall Security Solutions Under New Partnership
Yokogawa will offer Unidirectional Gateway cybersecurity products from Waterfall Security Solutions under a new collaboration
Schneider Electric Teams With BitSight on OT Risk Detection
Schneider Electric partnered with BitSight to develop a OT risk identification and threat intelligence capability
All ICS Vendors Impacted by OT:Icefall Vulnerabilities Have Released Advisories
All ICS vendors impacted by the recently-disclosed OT:Icefall vulnerabilities have released advisories to inform customers about the impact of the flaws and to provide mitigations.