Overview
CISA released two significant batches of ICS advisories in the first two weeks of July 2026: six advisories on July 2 and seven on July 7. Two vendor disclosures stand out for their implications beyond the immediate affected product: vulnerabilities in ST Engineering iDirect satellite communication terminals (affecting energy, maritime, and remote-site OT connectivity) and vulnerabilities in Hydro-Québec’s Le Circuit Électrique EV charging management system (representing the expanding OT attack surface of grid-connected transportation infrastructure).
This roundup covers the advisories most relevant to critical infrastructure operators, with emphasis on the satellite and building automation items that receive less routine attention than SCADA and PLC advisories.
ST Engineering iDirect Satellite Terminals — ICSA-26-183-01 through ICSA-26-183-04
Severity: Critical and High (multiple CVEs) Affected products: iDirect Evolution X1/X3/X5/X7 satellite modems, iDirect Velocity Series, iQ Desktop and Rack Satellite Modems Advisory batch: ICSA-26-183-01, ICSA-26-183-02, ICSA-26-183-03, ICSA-26-183-04
ST Engineering iDirect produces VSAT satellite communication terminals widely used for primary or backup connectivity in environments where terrestrial communications are unavailable or unreliable. Critical infrastructure deployments include:
- Offshore energy platforms (oil and gas rigs, wind farm substations) where satellite is the primary WAN link to shore-based operations centres
- Pipeline SCADA remote sites in geographically isolated locations
- Water and wastewater facilities in rural areas with no reliable fibre or cellular connectivity
- Maritime vessels with onboard OT and safety systems
- Mining and remote industrial sites where iDirect terminals carry both corporate WAN traffic and SCADA/OT communication tunnels
The July 2 advisory batch covered four distinct vulnerability classes across iDirect product lines.
Authentication Bypass in iDirect iVantage NMS
CVE-2026-31744 — Authentication bypass in the iVantage Network Management System web interface allows an unauthenticated remote attacker to gain administrative access to the NMS. iVantage is the centralised management platform for iDirect terminal fleets — a successful exploit against an operator’s iVantage instance could allow an attacker to reconfigure all managed terminals, disrupt satellite links, or redirect traffic.
CVSS: 9.1 (Critical)
Operational risk: In critical infrastructure deployments where iDirect terminals carry SCADA polling traffic, an attacker with iVantage access can selectively drop terminal connectivity, severing the communication path between remote field sites and control centres. This produces the same operational effect as a physical link cut — operators lose visibility into and control of remote OT assets — without requiring physical access to any site.
Remediation: Apply the vendor patch immediately. If the iVantage NMS is internet-accessible (common in managed service provider deployments), restrict access to operator IP ranges at the firewall level as an interim measure. This advisory should be treated as urgent: NMS-level authentication bypass has been exploited in ICS attacks prior to this disclosure.
Command Injection in iDirect Terminal Management Interface
CVE-2026-31745 — OS command injection in the iDirect terminal web management interface allows an authenticated attacker (or an unauthenticated attacker who has exploited CVE-2026-31744 first) to execute arbitrary commands in the context of the terminal’s Linux-based operating system.
CVSS: 8.8 (High)
The terminal’s embedded Linux environment has direct access to the satellite modem’s communication configuration. Command injection at this level enables an attacker to:
- Modify satellite link parameters, forcing re-registration or link dropout
- Exfiltrate VPN credentials or pre-shared keys stored in the terminal configuration
- Use the terminal as a pivot point into the connected OT or IT network
- Install persistent backdoors in the terminal firmware
Remediation: Apply vendor patch; rotate all credentials stored in terminal configurations if the management interface has been internet-accessible.
Hardcoded Credentials in Velocity Series
CVE-2026-31746 — Multiple hardcoded credentials exist in iDirect Velocity Series terminals, enabling unauthenticated access to diagnostic and configuration interfaces using documented factory credentials.
CVSS: 8.4 (High)
Hardcoded credential vulnerabilities in satellite terminals are particularly problematic because terminals are often physically remote and difficult to update. The Velocity Series is deployed across maritime and energy applications where physical access for remediation may require vessel travel or helicopter transport to offshore platforms.
Remediation: The vendor advisory provides firmware updates and guidance on disabling or changing the affected credential pathways. CISA strongly recommends applying the update and verifying that default credential paths are inaccessible on network interfaces post-update.
Information Disclosure in iQ Desktop Units
CVE-2026-31748 — Sensitive configuration information, including network topology details and VPN pre-shared keys, is disclosed through an unauthenticated API endpoint in iQ Desktop and Rack unit management interfaces.
CVSS: 7.5 (High)
This is the lowest-severity item in the batch but practically significant: VPN pre-shared keys retrieved from an iDirect terminal allow an attacker to authenticate into the encrypted tunnels that carry OT traffic across the satellite link. For operators running SCADA polling over iDirect VPN tunnels, this is effectively a credential for OT network access.
Hydro-Québec Le Circuit Électrique — ICSA-26-188-02 through ICSA-26-188-05
Severity: High (multiple CVEs) Affected products: Le Circuit Électrique EV charging management system, OCPP gateway, and backend cloud API Advisory batch: ICSA-26-188-02, ICSA-26-188-03, ICSA-26-188-04, ICSA-26-188-05
Hydro-Québec’s Le Circuit Électrique is one of Canada’s largest public EV charging networks, operated as an extension of the utility’s grid management infrastructure. The July 7 advisory batch addressed vulnerabilities in the management system that coordinates charging station operations, load balancing, and billing integration.
The security significance of EV charging management system vulnerabilities has grown substantially as utilities have integrated charging infrastructure into demand-response programs. A compromised EV charging management system can be used to manipulate aggregate charging load at a grid-connected scale.
API Authentication Weaknesses
CVE-2026-34112 — Broken access control in the Le Circuit Électrique backend API allows an authenticated user of the mobile application to access and modify charging session data for other users, including initiating, modifying, and terminating charging sessions for arbitrary charge point IDs.
CVSS: 7.6 (High)
Operational context: At individual charger scale, this is a user privacy and service disruption issue. At fleet scale, the ability to remotely terminate charging sessions across a large number of chargers simultaneously represents a mechanism for coordinated grid load manipulation. Demand-response capable charging stations that accept remote management commands are an emerging grid stability concern — NERC and FERC have identified aggregated EV charging control as a potential mechanism for grid destabilisation.
OCPP Gateway Input Validation
CVE-2026-34113 — Insufficient input validation in the OCPP (Open Charge Point Protocol) gateway allows a charging station operator with network access to the gateway to send crafted OCPP messages that cause backend processing errors, with potential for limited information disclosure about backend system configuration.
CVSS: 7.1 (High)
OCPP is the standard protocol used for communication between EV charging stations and their management backends. This vulnerability class — where malformed OCPP messages reach backend processing without adequate validation — has been a recurring theme in EV charging security research throughout 2025-2026. Charging station operators (including third-party operators with authorised access to submit OCPP transactions) can potentially probe backend architecture through crafted message sequences.
Moxa MXview One Industrial Network Manager — ICSA-26-188-06
CVE-2026-34219 and CVE-2026-34220 — CISA’s July 7 batch also included advisories for Moxa MXview One, a widely-used industrial network management platform for OT environments.
Severity: High (CVSS 8.1 and 7.8)
MXview One is deployed in manufacturing, energy, and transportation OT environments to manage Moxa industrial networking equipment. The two vulnerabilities in this advisory allow:
- CVE-2026-34219: SQL injection in the MXview One REST API, enabling authenticated users to extract database contents including user credentials, network topology data, and device configuration records
- CVE-2026-34220: Privilege escalation through improper session management, allowing standard users to perform administrative operations
Operational context: Industrial network management systems are attractive targets because they typically have network access to all managed devices on the OT network. An attacker who compromises an MXview One instance potentially gains visibility into the complete OT network topology and, through the administrative interface, the ability to reconfigure industrial networking equipment including managed switches, routers, and serial-to-Ethernet converters.
Remediation: Apply the Moxa firmware update for MXview One. Restrict REST API access to administrator-only accounts; if multiple account types currently have API access, review and revoke non-admin API access pending the patch deployment.
Advisory Prioritisation for OT Teams
With 13 advisories across two July batches, prioritisation is necessary. The following triage applies for most critical infrastructure operators:
Immediate (this week):
- CVE-2026-31744 (iDirect iVantage authentication bypass) — any operator with internet-accessible iVantage NMS should treat this as emergency priority. NMS-level access bypasses all terminal-level security.
- Moxa MXview One (CVE-2026-34219 and CVE-2026-34220) — OT network management systems with broad connectivity warrant prompt patching.
High priority (within patch cycle): 3. CVE-2026-31745, CVE-2026-31746, CVE-2026-31748 — iDirect terminal vulnerabilities require scheduled maintenance windows at potentially remote sites; begin logistics planning now. 4. Le Circuit Électrique OCPP vulnerabilities — Hydro-Québec and charging station operators should apply backend patches; no physical site visits required.
Sector-specific:
- Offshore energy and pipeline operators using iDirect VSAT: treat all four iDirect CVEs as operational risk items, not just security compliance items. Satellite link disruption at remote SCADA sites has direct operational consequence.
- NERC CIP-regulated utilities with EV charging infrastructure in grid demand-response programs: assess the Le Circuit Électrique advisories under applicable CIP standards for grid-connected systems.
Broader July 2026 Context
The July advisory batches continue the 2026 trend of ICS vulnerabilities appearing in infrastructure at the IT/OT convergence boundary — satellite terminals, network management systems, and EV charging backends are not traditional “ICS” products, but they carry OT traffic, manage OT networks, or represent grid-connected controllable loads. CISA’s inclusion of these products in ICS advisory batches reflects an evolving understanding of what constitutes the OT attack surface.
The iDirect advisories in particular illustrate a recurring pattern: remote site connectivity infrastructure receives less rigorous security review than SCADA and PLC software because it is procured and managed by IT or network operations teams rather than OT security teams, yet it sits directly in the path of OT communication. Satellite terminal management credentials, firmware security, and management interface exposure should be incorporated into OT security programs at operators who depend on VSAT connectivity for remote site operations.