Advisories › Siemens › ICSA-26-209-04

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP: 352 CVEs, Critical 9.8

Critical 9.8 Known exploited Oil & gas relevant ICSA-26-209-04 · Published Jul 28, 2026

Summary

CISA reports 352 vulnerabilities in Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) and 1 more. Weakness types: Missing Encryption of Sensitive Data, Missing Critical Step in Authentication, Improper Input Validation (+67 more). Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Highest CVSS v3 score: 9.8 (Critical), exploitable over the network. At least one CVE is on CISA's Known Exploited Vulnerabilities list.

What to do: Act now: Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. The vendor lists no fix for some issues, so lean on mitigations.
Why this matters for oil & gas: Siemens (SIMATIC S7, PCS 7, WinCC, RUGGEDCOM) is widely used in process plants and pipelines; Affected products include SIMATIC S7.

At a glance

Vendor
Siemens
Products
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0), SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0), SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0), SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
CVEs
CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-49994, CVE-2024-49998, CVE-2024-50014, CVE-2024-50063, CVE-2024-50164, CVE-2024-50298, CVE-2024-53124, CVE-2024-53170, CVE-2024-54458, CVE-2024-56631, CVE-2024-56703, CVE-2024-56719, CVE-2024-57917, CVE-2024-57924, CVE-2024-57973, CVE-2024-57977, CVE-2024-57979, CVE-2024-58011, CVE-2024-58016, CVE-2024-58020, CVE-2024-58056, CVE-2024-58058, CVE-2024-58061, CVE-2024-58086, CVE-2025-21645, CVE-2025-21648, CVE-2025-21655, CVE-2025-21676, CVE-2025-21682, CVE-2025-21702, CVE-2025-21705, CVE-2025-21706, CVE-2025-21707, CVE-2025-21718, CVE-2025-21731, CVE-2025-21745, CVE-2025-21758, CVE-2025-21760, CVE-2025-21764, CVE-2025-21765, CVE-2025-21780, CVE-2025-21795, CVE-2025-21796, CVE-2025-21802, CVE-2025-21814, CVE-2025-21846, CVE-2025-21853, CVE-2025-21861, CVE-2025-21864, CVE-2025-21867, CVE-2025-21875, CVE-2025-21887, CVE-2025-21913, CVE-2025-21919, CVE-2025-21925, CVE-2025-21926, CVE-2025-21938, CVE-2025-21959, CVE-2025-21999, CVE-2025-22005, CVE-2025-22015, CVE-2025-22055, CVE-2025-22056, CVE-2025-22060, CVE-2025-22083, CVE-2025-22090, CVE-2025-22095, CVE-2025-22107, CVE-2025-22111, CVE-2025-22121, CVE-2025-23136, CVE-2025-23143, CVE-2025-37785, CVE-2025-37909, CVE-2025-37917, CVE-2025-37945, CVE-2025-37959, CVE-2025-37964, CVE-2025-37972, CVE-2025-37980, CVE-2025-38125, CVE-2025-38162, CVE-2025-38192, CVE-2025-38201, CVE-2025-38232, CVE-2025-38322, CVE-2025-38591, CVE-2025-38614, CVE-2025-38681, CVE-2025-38704, CVE-2025-38721, CVE-2025-38725, CVE-2025-38727, CVE-2025-38732, CVE-2025-38736, CVE-2025-39681, CVE-2025-39691, CVE-2025-39721, CVE-2025-39748, CVE-2025-39756, CVE-2025-39764, CVE-2025-39770, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39826, CVE-2025-39827, CVE-2025-39845, CVE-2025-39866, CVE-2025-39871, CVE-2025-39931, CVE-2025-39953, CVE-2025-39955, CVE-2025-39964, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-40022, CVE-2025-40070, CVE-2025-40078, CVE-2025-40080, CVE-2025-40105, CVE-2025-40135, CVE-2025-40149, CVE-2025-40219, CVE-2025-40261, CVE-2025-40300, CVE-2025-61984, CVE-2025-61985, CVE-2025-68206, CVE-2025-68261, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68337, CVE-2025-68349, CVE-2025-68363, CVE-2025-68371, CVE-2025-68724, CVE-2025-68725, CVE-2025-68742, CVE-2025-68764, CVE-2025-68773, CVE-2025-68776, CVE-2025-68782, CVE-2025-68787, CVE-2025-68788, CVE-2025-68798, CVE-2025-68803, CVE-2025-68814, CVE-2025-68816, CVE-2025-68818, CVE-2025-68820, CVE-2025-71064, CVE-2025-71075, CVE-2025-71079, CVE-2025-71085, CVE-2025-71086, CVE-2025-71088, CVE-2025-71095, CVE-2025-71097, CVE-2025-71098, CVE-2025-71104, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71120, CVE-2025-71123, CVE-2025-71131, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71197, CVE-2025-71221, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2026-3497, CVE-2026-22977, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22992, CVE-2026-22994, CVE-2026-23003, CVE-2026-23005, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23026, CVE-2026-23038, CVE-2026-23054, CVE-2026-23060, CVE-2026-23083, CVE-2026-23084, CVE-2026-23086, CVE-2026-23087, CVE-2026-23095, CVE-2026-23100, CVE-2026-23103, CVE-2026-23110, CVE-2026-23111, CVE-2026-23113, CVE-2026-23154, CVE-2026-23204, CVE-2026-23231, CVE-2026-23242, CVE-2026-23243, CVE-2026-23245, CVE-2026-23270, CVE-2026-23271, CVE-2026-23273, CVE-2026-23274, CVE-2026-23277, CVE-2026-23284, CVE-2026-23287, CVE-2026-23290, CVE-2026-23293, CVE-2026-23300, CVE-2026-23304, CVE-2026-23319, CVE-2026-23321, CVE-2026-23335, CVE-2026-23340, CVE-2026-23343, CVE-2026-23351, CVE-2026-23359, CVE-2026-23365, CVE-2026-23368, CVE-2026-23370, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381, CVE-2026-23391, CVE-2026-23392, CVE-2026-23397, CVE-2026-23398, CVE-2026-23414, CVE-2026-23422, CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23446, CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23463, CVE-2026-23474, CVE-2026-23475, CVE-2026-27135, CVE-2026-31389, CVE-2026-31391, CVE-2026-31396, CVE-2026-31402, CVE-2026-31403, CVE-2026-31411, CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31427, CVE-2026-31428, CVE-2026-31431, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448, CVE-2026-31450, CVE-2026-31452, CVE-2026-31466, CVE-2026-31469, CVE-2026-31485, CVE-2026-31494, CVE-2026-31495, CVE-2026-31496, CVE-2026-31503, CVE-2026-31504, CVE-2026-31507, CVE-2026-31508, CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31533, CVE-2026-31546, CVE-2026-31555, CVE-2026-31563, CVE-2026-31565, CVE-2026-31628, CVE-2026-31634, CVE-2026-31649, CVE-2026-31651, CVE-2026-31658, CVE-2026-31664, CVE-2026-31665, CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31674, CVE-2026-31680, CVE-2026-31682, CVE-2026-31737, CVE-2026-31752, CVE-2026-31761, CVE-2026-31768, CVE-2026-40355, CVE-2026-41989, CVE-2026-43011, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43033, CVE-2026-43035, CVE-2026-43038, CVE-2026-43040, CVE-2026-43057, CVE-2026-43284, CVE-2026-46174, CVE-2026-46300, CVE-2026-46333
Highest CVSS v3
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Highest CVSS v4
–
Known exploited (KEV)
Yes
Sectors (per CISA)
Critical Manufacturing
Deployed
Worldwide
Vendor HQ
Germany

Vulnerabilities

CVEWeaknessCVSS v3CVSS v4KEVDescription (from advisory)
CVE-2021-41617Missing Encryption of Sensitive Data7.0–NoCVE-2021-41617
CVE-2023-28531Missing Encryption of Sensitive Data9.8–NoCVE-2023-28531
CVE-2023-51384Missing Critical Step in Authentication5.5–NoCVE-2023-51384
CVE-2023-52927Improper Input Validation4.7–NoCVE-2023-52927
CVE-2024-26783Improper Input Validation5.5–NoCVE-2024-26783
CVE-2024-27056Improper Input Validation5.5–NoCVE-2024-27056
CVE-2024-28956Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution5.6–NoCVE-2024-28956
CVE-2024-36903Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')5.6–NoCVE-2024-36903
CVE-2024-36927Improper Input Validation4.7–NoCVE-2024-36927
CVE-2024-42079NULL Pointer Dereference5.5–NoCVE-2024-42079
CVE-2024-46786Improper Input Validation7.8–NoCVE-2024-46786
CVE-2024-47736Improper Resource Shutdown or Release5.5–NoCVE-2024-47736
CVE-2024-47809NULL Pointer Dereference5.5–NoCVE-2024-47809
CVE-2024-49968Improper Input Validation5.5–NoCVE-2024-49968
CVE-2024-49994Integer Overflow or Wraparound5.5–NoCVE-2024-49994
CVE-2024-49998NULL Pointer Dereference4.7–NoCVE-2024-49998
CVE-2024-50014Use of Uninitialized Variable5.5–NoCVE-2024-50014
CVE-2024-50063Improper Enforcement of Behavioral Workflow6.7–NoCVE-2024-50063
CVE-2024-50164Improper Input Validation5.5–NoCVE-2024-50164
CVE-2024-50298NULL Pointer Dereference5.5–NoCVE-2024-50298
CVE-2024-53124Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')4.7–NoCVE-2024-53124
CVE-2024-53170Use After Free7.8–NoCVE-2024-53170
CVE-2024-54458Use After Free7.8–NoCVE-2024-54458
CVE-2024-56631Use After Free7.8–NoCVE-2024-56631
CVE-2024-56703Loop with Unreachable Exit Condition ('Infinite Loop')5.5–NoCVE-2024-56703
CVE-2024-56719Improper Input Validation5.5–NoCVE-2024-56719
CVE-2024-57917Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')5.7–NoCVE-2024-57917
CVE-2024-57924Reachable Assertion5.5–NoCVE-2024-57924
CVE-2024-57973Integer Overflow or Wraparound4.4–NoCVE-2024-57973
CVE-2024-57977Improper Locking5.5–NoCVE-2024-57977
CVE-2024-57979Use After Free7.8–NoCVE-2024-57979
CVE-2024-58011NULL Pointer Dereference5.5–NoCVE-2024-58011
CVE-2024-58016Improper Input Validation5.5–NoCVE-2024-58016
CVE-2024-58020NULL Pointer Dereference5.5–NoCVE-2024-58020
CVE-2024-58056Improper Input Validation5.5–NoCVE-2024-58056
CVE-2024-58058NULL Pointer Dereference5.5–NoCVE-2024-58058
CVE-2024-58061Improper Input Validation5.5–NoCVE-2024-58061
CVE-2024-58086Improper Input Validation4.4–NoCVE-2024-58086
CVE-2025-21645Improper Input Validation5.5–NoCVE-2025-21645
CVE-2025-21648Memory Allocation with Excessive Size Value5.5–NoCVE-2025-21648
CVE-2025-21655Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')4.7–NoCVE-2025-21655
CVE-2025-21676NULL Pointer Dereference5.5–NoCVE-2025-21676
CVE-2025-21682NULL Pointer Dereference5.5–NoCVE-2025-21682
CVE-2025-21702Improper Input Validation7.8–NoCVE-2025-21702
CVE-2025-21705Improper Input Validation5.5–NoCVE-2025-21705
CVE-2025-21706Improper Input Validation5.5–NoCVE-2025-21706
CVE-2025-21707Use of Uninitialized Resource5.5–NoCVE-2025-21707
CVE-2025-21718Use After Free7.0–NoCVE-2025-21718
CVE-2025-21731Use After Free7.8–NoCVE-2025-21731
CVE-2025-21745Missing Release of Memory after Effective Lifetime5.5–NoCVE-2025-21745
CVE-2025-21758Improper Input Validation5.5–NoCVE-2025-21758
CVE-2025-21760Use After Free7.8–NoCVE-2025-21760
CVE-2025-21764Use After Free7.8–NoCVE-2025-21764
CVE-2025-21765Improper Input Validation5.5–NoCVE-2025-21765
CVE-2025-21780Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')7.8–NoCVE-2025-21780
CVE-2025-21795Improper Input Validation5.5–NoCVE-2025-21795
CVE-2025-21796Use After Free7.8–NoCVE-2025-21796
CVE-2025-21802Improper Resource Locking5.5–NoCVE-2025-21802
CVE-2025-21814NULL Pointer Dereference5.5–NoCVE-2025-21814
CVE-2025-21846NULL Pointer Dereference5.5–NoCVE-2025-21846
CVE-2025-21853Improper Input Validation4.4–NoCVE-2025-21853
CVE-2025-21861Use After Free5.5–NoCVE-2025-21861
CVE-2025-21864NULL Pointer Dereference5.5–NoCVE-2025-21864
CVE-2025-21867Use After Free7.8–NoCVE-2025-21867
CVE-2025-21875Improper Input Validation5.5–NoCVE-2025-21875
CVE-2025-21887Use After Free7.8–NoCVE-2025-21887
CVE-2025-21913Improper Input Validation5.3–NoCVE-2025-21913
CVE-2025-21919Out-of-bounds Write7.8–NoCVE-2025-21919
CVE-2025-21925Improper Input Validation5.5–NoCVE-2025-21925
CVE-2025-21926Use After Free5.5–NoCVE-2025-21926
CVE-2025-21938Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')5.9–NoCVE-2025-21938
CVE-2025-21959Use of Uninitialized Resource5.5–NoCVE-2025-21959
CVE-2025-21999Use After Free7.8–NoCVE-2025-21999
CVE-2025-22005Missing Release of Memory after Effective Lifetime5.5–NoCVE-2025-22005
CVE-2025-22015NULL Pointer Dereference5.5–NoCVE-2025-22015
CVE-2025-22055Out-of-bounds Read7.1–NoCVE-2025-22055
CVE-2025-22056Out-of-bounds Write7.8–NoCVE-2025-22056
CVE-2025-22060Improper Input Validation5.5–NoCVE-2025-22060
CVE-2025-22083Use After Free7.8–NoCVE-2025-22083
CVE-2025-22090Incomplete Cleanup5.5–NoCVE-2025-22090
CVE-2025-22095Improper Input Validation5.5–NoCVE-2025-22095
CVE-2025-22107Improper Input Validation5.5–NoCVE-2025-22107
CVE-2025-22111Improper Input Validation5.5–NoCVE-2025-22111
CVE-2025-22121Out-of-bounds Read5.5–NoCVE-2025-22121
CVE-2025-23136NULL Pointer Dereference5.5–NoCVE-2025-23136
CVE-2025-23143NULL Pointer Dereference5.5–NoCVE-2025-23143
CVE-2025-37785Out-of-bounds Read5.5–NoCVE-2025-37785
CVE-2025-37909Improper Input Validation7.0–NoCVE-2025-37909
CVE-2025-37917Improper Input Validation7.0–NoCVE-2025-37917
CVE-2025-37945Improper Input Validation5.5–NoCVE-2025-37945
CVE-2025-37959Improper Input Validation7.0–NoCVE-2025-37959
CVE-2025-37964Improper Input Validation7.0–NoCVE-2025-37964
CVE-2025-37972Improper Input Validation5.5–NoCVE-2025-37972
CVE-2025-37980Improper Input Validation5.5–NoCVE-2025-37980
CVE-2025-38125Divide By Zero4.7–NoCVE-2025-38125
CVE-2025-38162Improper Input Validation7.0–NoCVE-2025-38162
CVE-2025-38192Improper Input Validation6.1–NoCVE-2025-38192
CVE-2025-38201Improper Input Validation5.5–NoCVE-2025-38201
CVE-2025-38232Improper Input Validation4.1–NoCVE-2025-38232
CVE-2025-38322Improper Input Validation5.5–NoCVE-2025-38322
CVE-2025-38591Improper Input Validation4.4–NoCVE-2025-38591
CVE-2025-38614Uncontrolled Recursion5.5–NoCVE-2025-38614
CVE-2025-38681Race Condition within a Thread6.5–NoCVE-2025-38681
CVE-2025-38704Improper Input Validation5.5–NoCVE-2025-38704
CVE-2025-38721Missing Release of Resource after Effective Lifetime5.5–NoCVE-2025-38721
CVE-2025-38725Improper Input Validation7.0–NoCVE-2025-38725
CVE-2025-38727Loop with Unreachable Exit Condition ('Infinite Loop')5.5–NoCVE-2025-38727
CVE-2025-38732Improper Update of Reference Count5.8–NoCVE-2025-38732
CVE-2025-38736Improper Input Validation5.5–NoCVE-2025-38736
CVE-2025-39681Divide By Zero5.5–NoCVE-2025-39681
CVE-2025-39691Use After Free4.4–NoCVE-2025-39691
CVE-2025-39721Improper Input Validation4.1–NoCVE-2025-39721
CVE-2025-39748Missing Default Case in Multiple Condition Expression5.5–NoCVE-2025-39748
CVE-2025-39756Missing Release of Memory after Effective Lifetime5.5–NoCVE-2025-39756
CVE-2025-39764Improper Update of Reference Count5.5–NoCVE-2025-39764
CVE-2025-39770Improper Following of Specification by Caller5.5–NoCVE-2025-39770
CVE-2025-39773Improper Locking5.5–NoCVE-2025-39773
CVE-2025-39782Improper Input Validation5.5–NoCVE-2025-39782
CVE-2025-39795Uncontrolled Recursion5.5–NoCVE-2025-39795
CVE-2025-39826Improper Input Validation5.5–NoCVE-2025-39826
CVE-2025-39827Improper Input Validation5.5–NoCVE-2025-39827
CVE-2025-39845Improper Input Validation5.5–NoCVE-2025-39845
CVE-2025-39866Use After Free7.8–NoCVE-2025-39866
CVE-2025-39871Improper Input Validation5.5–NoCVE-2025-39871
CVE-2025-39931Use of Uninitialized Variable5.5–NoCVE-2025-39931
CVE-2025-39953Improper Input Validation5.5–NoCVE-2025-39953
CVE-2025-39955Exposure of Sensitive Information Due to Incompatible Policies7.0–NoCVE-2025-39955
CVE-2025-39964Improper Input Validation5.5–Yes (added 2026-09-18)CVE-2025-39964
CVE-2025-39977Use After Free7.0–NoCVE-2025-39977
CVE-2025-39978Expired Pointer Dereference6.4–NoCVE-2025-39978
CVE-2025-39980Improper Input Validation7.0–NoCVE-2025-39980
CVE-2025-40022Incorrect Type Conversion or Cast5.3–NoCVE-2025-40022
CVE-2025-40070Improper Input Validation5.5–NoCVE-2025-40070
CVE-2025-40078Improper Input Validation5.5–NoCVE-2025-40078
CVE-2025-40080Improper Input Validation5.5–NoCVE-2025-40080
CVE-2025-40105Improper Input Validation5.5–NoCVE-2025-40105
CVE-2025-40135Expired Pointer Dereference7.0–NoCVE-2025-40135
CVE-2025-40149Use After Free5.0–NoCVE-2025-40149
CVE-2025-40219Improper Input Validation6.6–NoCVE-2025-40219
CVE-2025-40261Multiple Releases of Same Resource or Handle6.6–NoCVE-2025-40261
CVE-2025-40300Transmission of Private Resources into a New Sphere ('Resource Leak')6.5–NoCVE-2025-40300
CVE-2025-61984Improper Handling of Invalid Use of Special Elements3.6–NoCVE-2025-61984
CVE-2025-61985Improper Neutralization of Null Byte or NUL Character3.6–NoCVE-2025-61985
CVE-2025-68206Improper Handling of Missing Special Element5.5–NoCVE-2025-68206
CVE-2025-68261Time-of-check Time-of-use (TOCTOU) Race Condition5.5–NoCVE-2025-68261
CVE-2025-68264Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')5.5–NoCVE-2025-68264
CVE-2025-68265Expired Pointer Dereference5.5–NoCVE-2025-68265
CVE-2025-68266Improper Input Validation5.5–NoCVE-2025-68266
CVE-2025-68291Missing Initialization of Resource5.5–NoCVE-2025-68291
CVE-2025-68337Improper Input Validation5.5–NoCVE-2025-68337
CVE-2025-68349NULL Pointer Dereference7.5–NoCVE-2025-68349
CVE-2025-68363Improper Input Validation5.5–NoCVE-2025-68363
CVE-2025-68371Improper Input Validation5.5–NoCVE-2025-68371
CVE-2025-68724Integer Overflow or Wraparound5.5–NoCVE-2025-68724
CVE-2025-68725Improper Input Validation5.5–NoCVE-2025-68725
CVE-2025-68742Improper Input Validation5.5–NoCVE-2025-68742
CVE-2025-68764Incorrect Privilege Assignment6.1–NoCVE-2025-68764
CVE-2025-68773Improper Input Validation5.5–NoCVE-2025-68773
CVE-2025-68776NULL Pointer Dereference5.5–NoCVE-2025-68776
CVE-2025-68782Improper Input Validation5.5–NoCVE-2025-68782
CVE-2025-68787Improper Input Validation5.5–NoCVE-2025-68787
CVE-2025-68788Trust of System Event Data4.7–NoCVE-2025-68788
CVE-2025-68798Improper Input Validation4.7–NoCVE-2025-68798
CVE-2025-68803Improper Input Validation7.0–NoCVE-2025-68803
CVE-2025-68814Improper Input Validation5.5–NoCVE-2025-68814
CVE-2025-68816Use of Externally-Controlled Format String5.6–NoCVE-2025-68816
CVE-2025-68818NULL Pointer Dereference5.5–NoCVE-2025-68818
CVE-2025-68820Unchecked Return Value5.5–NoCVE-2025-68820
CVE-2025-71064Missing Initialization of Resource7.0–NoCVE-2025-71064
CVE-2025-71075Signal Handler Race Condition5.5–NoCVE-2025-71075
CVE-2025-71079Improper Input Validation5.5–NoCVE-2025-71079
CVE-2025-71085Improper Input Validation7.5–NoCVE-2025-71085
CVE-2025-71086Improper Input Validation5.5–NoCVE-2025-71086
CVE-2025-71088Race Condition within a Thread7.0–NoCVE-2025-71088
CVE-2025-71095Improper Input Validation5.5–NoCVE-2025-71095
CVE-2025-71097Missing Release of Resource after Effective Lifetime7.0–NoCVE-2025-71097
CVE-2025-71098Out-of-bounds Read6.2–NoCVE-2025-71098
CVE-2025-71104Incorrect Conversion between Numeric Types5.5–NoCVE-2025-71104
CVE-2025-71112Improper Input Validation7.0–NoCVE-2025-71112
CVE-2025-71113Improper Input Validation5.5–NoCVE-2025-71113
CVE-2025-71114Improper Input Validation5.5–NoCVE-2025-71114
CVE-2025-71120Improper Input Validation7.5–NoCVE-2025-71120
CVE-2025-71123Improper Input Validation5.5–NoCVE-2025-71123
CVE-2025-71131Expired Pointer Dereference5.5–NoCVE-2025-71131
CVE-2025-71161Loop with Unreachable Exit Condition ('Infinite Loop')5.5–NoCVE-2025-71161
CVE-2025-71162Improper Input Validation7.0–NoCVE-2025-71162
CVE-2025-71163Improper Input Validation5.5–NoCVE-2025-71163
CVE-2025-71185Improper Input Validation5.5–NoCVE-2025-71185
CVE-2025-71186Improper Input Validation5.5–NoCVE-2025-71186
CVE-2025-71189Improper Input Validation5.5–NoCVE-2025-71189
CVE-2025-71190Improper Input Validation5.5–NoCVE-2025-71190
CVE-2025-71191Improper Input Validation5.5–NoCVE-2025-71191
CVE-2025-71197Improper Input Validation5.5–NoCVE-2025-71197
CVE-2025-71221Improper Input Validation5.5–NoCVE-2025-71221
CVE-2025-71265Improper Input Validation5.5–NoCVE-2025-71265
CVE-2025-71266Loop with Unreachable Exit Condition ('Infinite Loop')5.5–NoCVE-2025-71266
CVE-2025-71267Loop with Unreachable Exit Condition ('Infinite Loop')4.6–NoCVE-2025-71267
CVE-2026-3497Use of Uninitialized Resource8.2–NoCVE-2026-3497
CVE-2026-22977Active Debug Code5.5–NoCVE-2026-22977
CVE-2026-22979Missing Release of Resource after Effective Lifetime5.5–NoCVE-2026-22979
CVE-2026-22980Use After Free7.8–NoCVE-2026-22980
CVE-2026-22982Improper Input Validation5.5–NoCVE-2026-22982
CVE-2026-22992Unchecked Return Value7.5–NoCVE-2026-22992
CVE-2026-22994Missing Release of Resource after Effective Lifetime5.5–NoCVE-2026-22994
CVE-2026-23003Use of Uninitialized Variable7.5–NoCVE-2026-23003
CVE-2026-23005Improper Input Validation5.5–NoCVE-2026-23005
CVE-2026-23010Expired Pointer Dereference7.8–NoCVE-2026-23010
CVE-2026-23011Buffer Underwrite ('Buffer Underflow')6.6–NoCVE-2026-23011
CVE-2026-23019Improper Input Validation4.7–NoCVE-2026-23019
CVE-2026-23026Missing Release of Resource after Effective Lifetime5.5–NoCVE-2026-23026
CVE-2026-23038Missing Release of Resource after Effective Lifetime5.5–NoCVE-2026-23038
CVE-2026-23054Improper Input Validation7.0–NoCVE-2026-23054
CVE-2026-23060Improper Input Validation7.0–NoCVE-2026-23060
CVE-2026-23083Improper Input Validation3.3–NoCVE-2026-23083
CVE-2026-23084NULL Pointer Dereference5.5–NoCVE-2026-23084
CVE-2026-23086Improper Input Validation6.2–NoCVE-2026-23086
CVE-2026-23087Improper Input Validation5.5–NoCVE-2026-23087
CVE-2026-23095Improper Input Validation7.5–NoCVE-2026-23095
CVE-2026-23100Improper Input Validation5.5–NoCVE-2026-23100
CVE-2026-23103Improper Resource Locking7.8–NoCVE-2026-23103
CVE-2026-23110Incorrect Synchronization5.5–NoCVE-2026-23110
CVE-2026-23111Use After Free7.8–NoCVE-2026-23111
CVE-2026-23113Loop with Unreachable Exit Condition ('Infinite Loop')5.5–NoCVE-2026-23113
CVE-2026-23154Improper Handling of Structural Elements3.3–NoCVE-2026-23154
CVE-2026-23204Improper Validation of Specified Index, Position, or Offset in Input7.1–NoCVE-2026-23204
CVE-2026-23231Use After Free7.8–NoCVE-2026-23231
CVE-2026-23242NULL Pointer Dereference7.5–NoCVE-2026-23242
CVE-2026-23243Incorrect Calculation of Buffer Size7.8–NoCVE-2026-23243
CVE-2026-23245Improper Input Validation7.8–NoCVE-2026-23245
CVE-2026-23270Use After Free7.8–NoCVE-2026-23270
CVE-2026-23271Operation on a Resource after Expiration or Release7.8–NoCVE-2026-23271
CVE-2026-23273Signal Handler Race Condition7.8–NoCVE-2026-23273
CVE-2026-23274Use of Uninitialized Resource7.8–NoCVE-2026-23274
CVE-2026-23277NULL Pointer Dereference5.9–NoCVE-2026-23277
CVE-2026-23284Improper Input Validation5.5–NoCVE-2026-23284
CVE-2026-23287Time-of-check Time-of-use (TOCTOU) Race Condition5.5–NoCVE-2026-23287
CVE-2026-23290Missing Initialization of Resource5.5–NoCVE-2026-23290
CVE-2026-23293Access of Uninitialized Pointer5.9–NoCVE-2026-23293
CVE-2026-23300Missing Initialization of Resource7.0–NoCVE-2026-23300
CVE-2026-23304NULL Pointer Dereference4.7–NoCVE-2026-23304
CVE-2026-23319Expired Pointer Dereference6.4–NoCVE-2026-23319
CVE-2026-23321Improper Update of Reference Count3.3–NoCVE-2026-23321
CVE-2026-23335Use of Uninitialized Resource3.3–NoCVE-2026-23335
CVE-2026-23340Signal Handler Race Condition7.8–NoCVE-2026-23340
CVE-2026-23343Integer Overflow or Wraparound5.5–NoCVE-2026-23343
CVE-2026-23351Expired Pointer Dereference7.8–NoCVE-2026-23351
CVE-2026-23359Out-of-bounds Write5.5–NoCVE-2026-23359
CVE-2026-23365Improper Validation of Specified Type of Input5.5–NoCVE-2026-23365
CVE-2026-23368Improper Input Validation5.5–NoCVE-2026-23368
CVE-2026-23370Plaintext Storage of a Password7.1–NoCVE-2026-23370
CVE-2026-23378Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')7.8–NoCVE-2026-23378
CVE-2026-23379Integer Overflow or Wraparound5.5–NoCVE-2026-23379
CVE-2026-23381Access of Uninitialized Pointer5.5–NoCVE-2026-23381
CVE-2026-23391Improper Update of Reference Count7.8–NoCVE-2026-23391
CVE-2026-23392Expired Pointer Dereference7.8–NoCVE-2026-23392
CVE-2026-23397Improper Handling of Length Parameter Inconsistency4.4–NoCVE-2026-23397
CVE-2026-23398NULL Pointer Dereference5.9–NoCVE-2026-23398
CVE-2026-23414Improper Update of Reference Count7.5–NoCVE-2026-23414
CVE-2026-23422Missing Report of Error Condition5.5–NoCVE-2026-23422
CVE-2026-23434Missing Synchronization7.1–NoCVE-2026-23434
CVE-2026-23438NULL Pointer Dereference5.5–NoCVE-2026-23438
CVE-2026-23439NULL Pointer Dereference5.5–NoCVE-2026-23439
CVE-2026-23446Deadlock5.5–NoCVE-2026-23446
CVE-2026-23449Time-of-check Time-of-use (TOCTOU) Race Condition7.8–NoCVE-2026-23449
CVE-2026-23450NULL Pointer Dereference9.8–NoCVE-2026-23450
CVE-2026-23452Signal Handler Race Condition5.5–NoCVE-2026-23452
CVE-2026-23454Expired Pointer Dereference5.5–NoCVE-2026-23454
CVE-2026-23455Out-of-bounds Read9.1–NoCVE-2026-23455
CVE-2026-23456Out-of-bounds Read8.2–NoCVE-2026-23456
CVE-2026-23457Incorrect Conversion between Numeric Types8.6–NoCVE-2026-23457
CVE-2026-23458Improper Update of Reference Count7.8–NoCVE-2026-23458
CVE-2026-23463Time-of-check Time-of-use (TOCTOU) Race Condition5.5–NoCVE-2026-23463
CVE-2026-23474Buffer Access with Incorrect Length Value5.5–NoCVE-2026-23474
CVE-2026-23475Access of Uninitialized Pointer5.5–NoCVE-2026-23475
CVE-2026-27135Reachable Assertion7.5–NoCVE-2026-27135
CVE-2026-31389Expired Pointer Dereference7.8–NoCVE-2026-31389
CVE-2026-31391Improper Update of Reference Count5.5–NoCVE-2026-31391
CVE-2026-31396Expired Pointer Dereference7.8–NoCVE-2026-31396
CVE-2026-31402Out-of-bounds Write9.8–NoCVE-2026-31402
CVE-2026-31403Expired Pointer Dereference7.8–NoCVE-2026-31403
CVE-2026-31411Untrusted Pointer Dereference7.1–NoCVE-2026-31411
CVE-2026-31414Improper Input Validation9.8–NoCVE-2026-31414
CVE-2026-31415Integer Overflow or Wraparound5.5–NoCVE-2026-31415
CVE-2026-31416Incorrect Calculation of Buffer Size5.5–NoCVE-2026-31416
CVE-2026-31417Integer Overflow or Wraparound7.5–NoCVE-2026-31417
CVE-2026-31418Improper Input Validation5.5–NoCVE-2026-31418
CVE-2026-31421NULL Pointer Dereference5.5–NoCVE-2026-31421
CVE-2026-31422NULL Pointer Dereference4.7–NoCVE-2026-31422
CVE-2026-31423Divide By Zero5.5–NoCVE-2026-31423
CVE-2026-31424Improper Validation of Specified Type of Input5.5–NoCVE-2026-31424
CVE-2026-31427Access of Uninitialized Pointer5.8–NoCVE-2026-31427
CVE-2026-31428Access of Uninitialized Pointer5.5–NoCVE-2026-31428
CVE-2026-31431Incorrect Resource Transfer Between Spheres7.8–Yes (added 2026-05-01)CVE-2026-31431
CVE-2026-31441Improper Input Validation5.5–NoCVE-2026-31441
CVE-2026-31446Improper Input Validation7.8–NoCVE-2026-31446
CVE-2026-31447Improper Input Validation7.8–NoCVE-2026-31447
CVE-2026-31448Improper Input Validation9.4–NoCVE-2026-31448
CVE-2026-31450Improper Input Validation8.8–NoCVE-2026-31450
CVE-2026-31452Improper Input Validation7.8–NoCVE-2026-31452
CVE-2026-31466Race Condition within a Thread5.5–NoCVE-2026-31466
CVE-2026-31469Improper Input Validation7.8–NoCVE-2026-31469
CVE-2026-31485Improper Input Validation7.8–NoCVE-2026-31485
CVE-2026-31494Out-of-bounds Write7.8–NoCVE-2026-31494
CVE-2026-31495Improper Validation of Specified Type of Input5.5–NoCVE-2026-31495
CVE-2026-31496Improper Input Validation5.5–NoCVE-2026-31496
CVE-2026-31503Improper Input Validation5.5–NoCVE-2026-31503
CVE-2026-31504Improper Input Validation7.8–NoCVE-2026-31504
CVE-2026-31507Improper Input Validation7.8–NoCVE-2026-31507
CVE-2026-31508Improper Input Validation7.8–NoCVE-2026-31508
CVE-2026-31515Incorrect Calculation of Buffer Size7.0–NoCVE-2026-31515
CVE-2026-31518Missing Release of Resource after Effective Lifetime5.5–NoCVE-2026-31518
CVE-2026-31521Improper Validation of Specified Index, Position, or Offset in Input7.0–NoCVE-2026-31521
CVE-2026-31533Release of Invalid Pointer or Reference9.8–NoCVE-2026-31533
CVE-2026-31546NULL Pointer Dereference5.5–NoCVE-2026-31546
CVE-2026-31555Expired Pointer Dereference5.5–NoCVE-2026-31555
CVE-2026-31563Improper Input Validation7.5–NoCVE-2026-31563
CVE-2026-31565Improper Input Validation5.5–NoCVE-2026-31565
CVE-2026-31628Improper Input Validation5.5–NoCVE-2026-31628
CVE-2026-31634Improper Input Validation5.5–NoCVE-2026-31634
CVE-2026-31649Improper Input Validation9.8–NoCVE-2026-31649
CVE-2026-31651Improper Input Validation5.5–NoCVE-2026-31651
CVE-2026-31658Improper Input Validation5.5–NoCVE-2026-31658
CVE-2026-31664Improper Input Validation5.5–NoCVE-2026-31664
CVE-2026-31665Improper Input Validation7.8–NoCVE-2026-31665
CVE-2026-31669Improper Input Validation9.8–NoCVE-2026-31669
CVE-2026-31670Improper Input Validation5.5–NoCVE-2026-31670
CVE-2026-31671Improper Input Validation5.5–NoCVE-2026-31671
CVE-2026-31674Improper Input Validation7.1–NoCVE-2026-31674
CVE-2026-31680Improper Input Validation7.8–NoCVE-2026-31680
CVE-2026-31682Improper Input Validation9.1–NoCVE-2026-31682
CVE-2026-31737Improper Input Validation5.5–NoCVE-2026-31737
CVE-2026-31752Buffer Access with Incorrect Length Value7.0–NoCVE-2026-31752
CVE-2026-31761Time-of-check Time-of-use (TOCTOU) Race Condition7.8–NoCVE-2026-31761
CVE-2026-31768Improper Input Validation7.8–NoCVE-2026-31768
CVE-2026-40355NULL Pointer Dereference5.9–NoCVE-2026-40355
CVE-2026-41989Out-of-bounds Write6.7–NoCVE-2026-41989
CVE-2026-43011Improper Input Validation9.8–NoCVE-2026-43011
CVE-2026-43024Misinterpretation of Input5.5–NoCVE-2026-43024
CVE-2026-43025Out-of-bounds Read7.3–NoCVE-2026-43025
CVE-2026-43026Access of Uninitialized Pointer5.5–NoCVE-2026-43026
CVE-2026-43027Incomplete Cleanup7.1–NoCVE-2026-43027
CVE-2026-43028Improper Null Termination7.1–NoCVE-2026-43028
CVE-2026-43030Incomplete Internal State Distinction7.8–NoCVE-2026-43030
CVE-2026-43033Improper Handling of Structural Elements7.8–NoCVE-2026-43033
CVE-2026-43035Use of Uninitialized Resource5.5–NoCVE-2026-43035
CVE-2026-43038Access of Resource Using Incompatible Type ('Type Confusion')9.8–NoCVE-2026-43038
CVE-2026-43040Missing Initialization of Resource7.0–NoCVE-2026-43040
CVE-2026-43057Improperly Implemented Security Check for Standard7.5–NoCVE-2026-43057
CVE-2026-43284Write-what-where Condition8.8–NoCVE-2026-43284
CVE-2026-46174Improper Input Validation8.8–NoCVE-2026-46174
CVE-2026-46300Write-what-where Condition7.8–NoCVE-2026-46300
CVE-2026-46333Improper Privilege Management7.1–NoCVE-2026-46333

Affected products (5)

Vendor fixes and mitigations (from advisory)

Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.

Sources

This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.

Weekly OT patch digest

Every week: the new ICS advisories that touch oil & gas gear, what they mean, and what to do. Free.

TODO: signup form not connected to a provider yet