CISA’s August 2026 ICS advisories continued the pattern of disclosures that has made this year’s advisory volume the highest on record. The first week of August produced advisories covering three major vendors — Siemens, Honeywell, and GE Vernova — with vulnerabilities spanning network management systems, distributed control systems, and grid management platforms. Several carry CVSS scores above 8.0 and affect software versions actively deployed in energy, manufacturing, and utility environments.
This roundup summarises the key advisories, affected versions, and the practical mitigation steps for OT teams.
Siemens SINEC NMS — Multiple Vulnerabilities (ICSA-26-218-01)
CVE count: 7 vulnerabilities
Highest CVSS: 9.1 (Critical)
Affected product: SINEC NMS versions prior to V3.0 SP1
SINEC NMS is Siemens’ network management system for industrial network infrastructure — routers, switches, firewalls, and other network components in OT environments. The advisory covers a cluster of vulnerabilities in the web interface and API layer:
CVE-2026-38501 (CVSS 9.1): SQL injection in the SINEC NMS API endpoint /api/v2/devices/query. The endpoint accepts unsanitised query parameters that are passed directly to the underlying database. An authenticated user with low privileges can exfiltrate the full SINEC database, including credentials, device configurations, and network topology. An authenticated-but-low-privilege condition reduces the realistic attack surface somewhat, but initial access through default or weak credentials is common in OT management systems.
CVE-2026-38502 (CVSS 8.8): Server-Side Request Forgery (SSRF) via the device configuration import function. An attacker can supply a crafted import URL that causes the SINEC server to make HTTP requests to internal OT network hosts, effectively turning SINEC NMS into a pivot point for scanning internal industrial network segments that may not be directly accessible.
CVE-2026-38503 (CVSS 7.5): Stored XSS in device display name fields. Device names entered by users (including those discovered via SNMP/LLDP) are rendered in the dashboard without sanitisation. An attacker with the ability to influence device hostnames — including through a compromised network device — can inject scripts executed in the context of any SINEC NMS user’s browser session.
Remaining CVEs: Four medium-severity vulnerabilities covering insecure password storage (bcrypt with insufficient cost factor), verbose error messages exposing internal paths, and session token fixation.
Mitigations:
- Update to SINEC NMS V3.0 SP1 or later (Siemens published update August 5, 2026)
- Restrict SINEC NMS web interface access to dedicated OT management VLANs
- Review and change all SINEC NMS account credentials, particularly default accounts
- Enable audit logging and monitor for unusual API queries or configuration export events
Honeywell Experion PKS — Authentication Bypass (ICSA-26-218-03)
CVE: CVE-2026-40127
CVSS: 8.6 (High)
Affected product: Honeywell Experion PKS C300 Controller, firmware versions prior to R520.1 HF3
Experion PKS (Process Knowledge System) is Honeywell’s distributed control system platform, widely deployed in oil and gas, refining, chemical, and power generation environments. The affected C300 controller handles real-time process control functions.
CVE-2026-40127 is an authentication bypass in the Experion PKS Controller Development Studio (CDS) interface. The CDS interface allows engineers to download and upload controller logic (LOGIC+ programs) to the C300. The bypass enables an attacker on the same OT network segment as the C300 to authenticate to the CDS interface without valid credentials by replaying a crafted session token from a previous legitimate session.
The session token does not include a timestamp validation component, meaning captured tokens remain valid indefinitely. In practice, an attacker who has achieved network access to the OT segment hosting C300 controllers — through phishing of engineering workstations, VPN compromise, or physical access — can replay a previously observed session token to obtain full write access to controller logic.
The impact of arbitrary controller logic modification on process safety and availability in affected sectors (particularly oil/gas and chemical) is severe.
Mitigations:
- Apply firmware update R520.1 HF3 (contact Honeywell support for update package)
- Isolate C300 controllers to a dedicated process control VLAN with no direct connectivity from corporate networks or DMZ
- Monitor CDS authentication events for sessions originating from unexpected source IPs
- Implement network-level controls restricting access to the CDS interface to specific authorised engineering workstations by IP or MAC address
- Enable session logging on engineering workstations to capture CDS session initiation
Temporary workaround (if patching is not immediately feasible): Honeywell recommends disabling remote CDS access and requiring in-person, console-only controller access until the firmware update can be applied.
GE Vernova Grid Solutions — SCADA Command Injection (ICSA-26-218-07)
CVE: CVE-2026-41773
CVSS: 8.8 (High)
Affected product: GE Vernova e-terracontrol SCADA, versions 7.6.x through 7.8.x
GE Vernova’s e-terracontrol is a SCADA and EMS (Energy Management System) platform used by electric utilities for grid monitoring and control. The vulnerability is a command injection in the historian data import function.
The import function accepts external data files for bulk loading of historical generation and grid telemetry data. The file parsing routine passes the filename parameter to a shell command without sanitisation:
# Internal processing (simplified)
system("import_tool --file " + user_supplied_filename + " --format CSV")An attacker who can submit a crafted filename — through the web interface, API, or a compromised data feed — can inject shell commands that execute with the privileges of the e-terracontrol SCADA service, which in most deployments runs with elevated system privileges.
Exploitation requires network access to the e-terracontrol web interface. The web interface is typically accessible to utility control room operators and, in some configurations, to authorised third-party data providers submitting generation dispatch data.
Mitigations:
- Apply GE Vernova patch GV-2026-073 (published August 6, 2026)
- Restrict the historian import function to specific authorised source IPs
- Validate imported file content and filename parameters at the application layer (the patch includes input validation changes)
- Monitor for unexpected shell process spawning from the e-terracontrol service context
Additional Advisories: Brief Summaries
ICSA-26-218-02 — Mitsubishi Electric MELSOFT MX Component (CVSS 7.8): Stack-based buffer overflow in the ActiveX control component. Exploitation requires user interaction (opening a crafted project file). Affects versions 4.20F and earlier. Update to 4.21A.
ICSA-26-218-05 — Rockwell Automation FactoryTalk Historian SE (CVSS 7.5): Path traversal in the file retrieval API allows unauthenticated read of arbitrary files from the historian server filesystem. Affects versions prior to 8.10. Workaround: restrict API access to trusted historian clients via firewall rules. Patch expected mid-August.
ICSA-26-218-08 — Schneider Electric EcoStruxure Geo SCADA Expert (CVSS 6.8): Improper certificate validation in the ClearSCADA server’s HTTPS client allows man-in-the-middle interception of data synchronisation between distributed SCADA nodes. Affects versions 2021 R2.2 and earlier. Update to 2021 R2.3.
Patch Prioritisation Guidance
Given typical OT change management cycles, not all of these can be patched immediately. Prioritise based on:
-
CVE-2026-40127 (Honeywell Experion PKS, CVSS 8.6): Authentication bypass on a process controller in sectors with high physical impact potential. Highest priority for energy, oil/gas, and chemical operators.
-
CVE-2026-38501 (Siemens SINEC NMS, CVSS 9.1): SQL injection in a network management system. High priority because SINEC NMS has visibility into, and connectivity with, OT network infrastructure — compromise has a wide blast radius.
-
CVE-2026-41773 (GE Vernova e-terracontrol, CVSS 8.8): Command injection in a utility SCADA platform. High priority for electric utilities with the affected versions deployed.
-
Remaining advisories (CVSS ≤ 7.8): Apply through standard OT maintenance windows.