Industrial & Operational Technology
Bosch Rexroth PRI7000 Updates Bundled 7-Zip for CVE-2026-14266
Bosch updated PRI7000 for a High-severity 7-Zip XZ parsing flaw. Match the exact branch, update engineering stations, test, and retain evidence.
ABB AC500 V3 Firmware Fixes Web Visualization Denial of Service
ABB AC500 V3 firmware 3.9.1 fixes denial of service in running web visualization servers. Coordinate controller maintenance with the process owner; updating Automation Builder alone does not prove the controller has received the firmware.
ABB Automation Builder 2.9.1 Fixes Project File Code Execution
ABB Automation Builder 2.9.1 fixes project-file code execution involving print or printer-setting interaction. Update engineering workstations and restrict untrusted projects; obtain ABB clarification before relying on the incompletely documented local-access-only workaround.
ABB PCM600 Scheduler Service Requires Privilege-Escalation Workaround
ABB PCM600 Scheduler has a local privilege-escalation flaw with a documented service-account workaround, not a fixed release. Coordinate changes with the engineering owner and preserve certificate validation; changing accounts does not repair the permission defect.
ABB PCM600 Hotfix Blocks Project-Import Path Traversal
ABB PCM600 2.14 Hotfix 20260923 fixes project-archive path traversal using the importing user's permissions. Restrict untrusted imports while updating; this hotfix does not resolve the separate Scheduler privilege-escalation issue.
OpenPLC Runtime v4 Replaces Vulnerable End-of-Life v3
End-of-life OpenPLC Runtime v3 has a web-interface script-injection flaw that can affect operator sessions. Limit exposure and plan an operations-approved v4 migration, validating programs, I/O and safe-state recovery offline before cutover.
lwIP Fixes MQTT and API Memory-Corruption Vulnerabilities
lwIP MQTT and API flaws have different network scopes and separate fixes. Identify affected embedded devices and obtain supported firmware containing the applicable commits; updating a source checkout alone does not remediate deployed equipment.
RTI Connext Updates Address Nineteen Vulnerabilities
RTI Connext Professional and AUTOSAR Toolkit updates cover nineteen vulnerabilities with different component, architecture and configuration requirements. Match each deployed branch to its supported patch and plan rebuild, redeployment and interoperability checks.