The US Cybersecurity and Infrastructure Security Agency’s industrial-control-systems division published five new security advisories and updated two existing ones on August 27, 2026, covering vulnerabilities in equipment from Ebyte, Applied Systems Engineering, Rockwell Automation, All-Line Equipment, and Xiiaozet, alongside updates to prior Mitsubishi Electric advisories, according to CISA’s own advisory feed and tracking by WaterISAC and independent ICS-security researcher Patrick Coyle.
The affected products span control and monitoring equipment used across multiple critical-infrastructure sectors, including energy and water utilities. CISA advisories of this kind typically detail vulnerability type, affected product versions, and vendor-issued mitigations, and are used by asset owners to prioritize patching across operational-technology environments that are often harder to update than conventional IT systems.
Part of a Steady Weekly Cadence of ICS Disclosures
CISA has issued ICS advisories at a near-weekly pace throughout August, including a batch of 15 advisories on August 13 and a separate advisory for a Johnson Controls product on August 20, reflecting both increased vendor disclosure activity and continued research attention on operational-technology security. The agency encourages asset owners and operators to review each advisory for applicability and apply recommended mitigations, particularly where affected systems are internet-accessible.
No advisory in this batch indicates active exploitation, distinguishing it from the actively exploited flaws disclosed elsewhere this week, including the Gitea remote-code-execution vulnerability already being used to deploy cryptomining malware.
Leave a Reply