Cyberattack Law and Disclosure Digest for 2026-09-24

Summary of official government advisories, court filings, and sanctions published on 2026-09-24.

CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗

 CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
• CVE-2026-71362 Adobe Commerce and Mage

  CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗

  CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
  • CVE-2026-87886 A

    CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

    • CVE-2025-39964 Linux Kernel Race Condition Vulnerability
    • CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vuln

      Siemens Siveillance Control ↗

      View CSAF

      Summary

      A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access on the OIS server. Siemens has released p

      Siemens Industrial Edge Management ↗

      View CSAF

      Summary

      Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versio

      lwIP (Lightweight IP) ↗

      View CSAF

      Summary

      Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system.

      The following versions of lwIP (Lightweight IP) are affected:

      • API >=2.0.1|<=2.2.1 (CVE-2026-91018)

      ## [Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators](https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators) Source: CISA Advisory

      Introduction

      The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) - hereafter referred to as the “authoring agencies” - have published this fact sheet to highlight considerations for critical infrastructure entities to reduce risk and minimize vulnerabilities when working with third-party industrial control system (ICS) integrators.

      ICS is an umbrella term referring to integrated networks of hardware and software de

      Siemens WTV676 and WTV776 ↗

      View CSAF

      Summary

      The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain conditions. This disables remote connectivity functions (Web Access) to the devices. Siemens has released new versions for the affected products and recommends to update to the late

      Botslab G980H Dashcams ↗

      View CSAF

      Summary

      Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation.

      The following versions of Botslab G980H Dashcams are affected:

      Siemens Desigo CC family ↗

      View CSAF

      Summary

      A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances

      lwIP TCP/IP Stack MQTT Client Application ↗

      View CSAF

      Summary

      Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device.

      The following versions of lwIP TCP/IP Stack MQTT Client Application are affected:

      • MQTT Client Application >=2.0.1|<=2.2.1 (CVE-2026-87121)

      CISA Adds One Known Exploited Vulnerability to Catalog ↗

      CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

      • CVE-2026-58704 Google Pixel Improper Authorization Vulnerability

      This type of vulnerability is a frequent attack vector for mali

      Schneider Electric PowerChute Serial Shutdown ↗

      View CSAF

      Summary

      Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Failure to apply the remediation provided below may risk improper a

      Hitachi Energy FACTS Control Platform (FCP) ↗

      View CSAF

      Summary

      Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product. Following FACTS Control systems with GWS component deployed from year 2020 onwards a

      Mitsubishi Electric GX Works3 and Motion Control Settings ↗

      View CSAF

      Summary

      Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.

      T

      Siemens SIPLUS and SIMATIC Products ↗

      View CSAF

      Summary

      Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

      Eufy Omni C20, Omni X10 Pro ↗

      View CSAF

      Summary

      Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code.

      The following versions of Eufy Omni C20, Omni X10 Pro are affected:

      • Omni C20 <1.6.4 (CVE-2026-93289, CVE-2026-93290, CVE-2026-93291)
      • Omni X10 Pro <1.6.4 (CVE-202

        CISA Adds One Known Exploited Vulnerability to Catalog ↗

        CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

        • CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

        This type of vulnerability is a frequent attack vector for malicious cyber actors and pos

        Bransys ELD ↗

        View CSAF

        Summary

        Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware.

        The following versions of Bransys ELD are affected:

        • Android <11.00.00 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960)
        • iOS <1.1.54 (CVE-2026-86520, CVE-2026-86689, CVE-2026-7796

          Siemens SIMOVE Fleetmanager and SIPLANT ↗

          View CSAF

          Summary

          SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended scope. Siemens has released new versions for the affected products and recommends to update to the latest versions.

          The following versions of Siemens SIMOVE Fleetmanager and SIPLANT

          CISA Adds One Known Exploited Vulnerability to Catalog ↗

          CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

          • CVE-2026-7273 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

          This type of vulnerability is a frequent attack vector for malicious cyber actors and poses signific

          Schneider Electric Modicon M340 Controller and Communication Modules ↗

          View CSAF

          Summary

          Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR0200H Using Cyber Decoys to Strengthen Detection and Response ↗

          CISA developed this guidance to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies that strengthen their detection and response capabilities. Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and

          ABB Ability Edgenius ↗

          View CSAF

          Summary

          ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE‑2026‑31431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised contain

          Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A) ↗

          View CSAF

          Summary

          Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected prod

          Siemens Mendix Runtime (Update A) ↗

          View CSAF

          Summary

          This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.

          The following versions of Siemens Mendix Runtime are affected:

          • Siemens Mendix Runtime vers:all/* (CVE-2026-7891)

          <

          Schneider Electric SCADAPack x70 Products ↗

          View CSAF

          Summary

          Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase t

          OpenPLC Runtime v3 ↗

          View CSAF

          Summary

          Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives.

          The following versions of OpenPLC Runtime v3 are affected:<

          Schneider Electric NetBotz 5 750/755 ↗

          View CSAF

          Summary

          Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 - 750/755 products.The NetBotz 5 - 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities. Failure to apply the remediation provided below may risk arbitr

          CISA Adds Four Known Exploited Vulnerabilities to Catalog ↗

          CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

          • CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability
          • CVE-2026-93616 Check Point Multip