ICS Patch Tuesday June 2026: Critical Vulnerabilities in Siemens, Honeywell, and Mitsubishi Electric Products

Overview

June 2026’s ICS Patch Tuesday cycle aligns with Microsoft’s record-breaking IT security update release, and the OT/ICS advisory volume reflects the same trend toward increasing vulnerability disclosure velocity in industrial environments. CISA published multiple ICS advisories covering products from Siemens, Honeywell, Mitsubishi Electric, and other vendors deployed across energy, manufacturing, water, and building automation sectors.

OT security teams face a compounding challenge: many of these vulnerabilities affect equipment that cannot be patched using the same lifecycle as IT endpoints. PLC firmware updates and HMI software patches require change windows coordinated with operations, vendor-supplied qualification testing, and in some cases physical access to devices in the field. The triage and planning window for OT patches is typically longer than for IT, making timely awareness of new advisories critical.

Siemens Advisories

Sinec NMS — Authentication and Authorisation Bypass

Siemens Network Management System (Sinec NMS) has been updated to address multiple vulnerabilities including authentication bypass and privilege escalation in the web management interface. Sinec NMS is widely deployed for network monitoring and management in industrial environments, including energy distribution substations and manufacturing plants.

Key risk: An unauthenticated attacker with network access to the Sinec NMS web interface could exploit the authentication bypass to gain administrative access to the network management platform, enabling configuration changes to managed devices, traffic capture, and network disruption.

Affected versions: Sinec NMS prior to V2.0 SP2

Remediation: Update to V2.0 SP2 or later. If immediate update is not feasible, restrict network access to the Sinec NMS web interface to authorised management hosts using firewall rules or VLAN segmentation.

Ruggedcom Crossbow — Privilege Escalation and Code Execution

Siemens Ruggedcom Crossbow, a network management and security monitoring solution for critical infrastructure networks, contains vulnerabilities allowing privilege escalation, code execution, and denial of service. Ruggedcom Crossbow is deployed in energy and utility environments where it monitors Ruggedcom-series industrial networking equipment.

Key risk: An authenticated attacker with low-level access to Ruggedcom Crossbow can escalate privileges and execute arbitrary code on the management server. Given Crossbow’s visibility into and management of industrial network infrastructure, this represents a significant attack surface in operational environments.

Affected versions: Ruggedcom Crossbow versions prior to the patched release (consult Siemens ProductCERT for version specifics)

Remediation: Apply Siemens-supplied patch via ProductCERT. Restrict Crossbow administrative access to dedicated OT management hosts.

Industrial Edge Management — Authorisation Bypass

Siemens Industrial Edge Management Platform contains an authorisation bypass vulnerability that could allow an attacker with lower-level access to perform administrative operations. Industrial Edge Management is the platform for deploying and managing edge applications on Siemens industrial edge devices.

Impact: In environments using edge computing for real-time analytics, quality control, or process optimisation on Siemens industrial hardware, a compromise of the Edge Management platform gives an attacker control over deployed edge applications and access to the operational data processed by those applications.

Honeywell Advisories

Honeywell Experion PKS — Multiple Vulnerabilities

Honeywell’s Experion Process Knowledge System (PKS), a distributed control system (DCS) deployed extensively in oil and gas, chemical, and pharmaceutical manufacturing, has received an advisory addressing multiple vulnerabilities including improper input validation and memory handling issues.

Sector impact: Experion PKS is one of the most widely deployed DCS platforms in process manufacturing. Vulnerabilities affecting this platform have direct process safety implications — the DCS is the primary system for executing automated control of physical processes, and control system disruption can trigger safety interlocks, process shutdown, or in the worst case, contribute to unsafe process conditions.

Remediation: Honeywell has issued patched firmware and hotfix releases through its security advisory portal. Asset owners should contact Honeywell support for guidance on the specific remediation path for their Experion version and deployment configuration. Until patching is complete:

• Restrict network access to Experion servers to authorised engineering workstations
• Disable any remote access to the DCS that is not actively required
• Increase monitoring of change events on the Experion system

Honeywell OneWireless Wireless Device Manager

OneWireless Wireless Device Manager, used for managing Honeywell’s industrial wireless field device infrastructure, contains hardware-level vulnerabilities affecting multiple wireless gateway devices. The advisory addresses improper restriction of operations within memory buffer bounds.

OT impact: Wireless device networks are increasingly deployed in process plants as supplements to wired HART and fieldbus infrastructure. Compromise of the Wireless Device Manager could affect visibility into field instrument status and enable adversarial interference with wireless process measurements.

Mitsubishi Electric Advisories

MELSEC Series PLC Vulnerabilities

Mitsubishi Electric has published advisories addressing vulnerabilities in multiple MELSEC series PLC product lines, including the MELSEC iQ-R series and the MELSEC-Q/L series. The advisories cover denial-of-service vulnerabilities that can be triggered by malformed packets sent to the PLC’s Ethernet communication module.

Exploitation conditions: Exploitation requires network access to the PLC’s Ethernet port. MELSEC PLCs are deployed across discrete manufacturing, automotive, food and beverage, and infrastructure control applications. Unprotected PLCs reachable from the plant network (or from DMZ environments with insufficient segmentation) are at risk.

Recommended mitigations:

1. Apply firmware updates per Mitsubishi Electric’s advisory where available
2. Implement firewall rules or network ACLs restricting access to PLC Ethernet ports to authorised engineering workstations only
3. Use read-only firewall rules to block MC Protocol (port 5007) and SLMP access from segments that do not require it
4. Enable Mitsubishi’s IP filter function on MELSEC iQ-R CPUs where firmware version supports it

# Example ACL approach for Cisco network infrastructure protecting PLC subnet:
ip access-list extended MELSEC-PROTECT
 permit tcp 10.0.10.0 0.0.0.255 10.0.20.0 0.0.0.255 eq 5007    # eng workstations only
 deny   tcp any 10.0.20.0 0.0.0.255 eq 5007                      # deny all others
 permit ip any any

Triage Priorities for OT Security Teams

Given the volume of advisories across multiple vendors, use the following prioritisation framework:

Priority 1 — Patch within 30 days (next planned maintenance window):

• Siemens Sinec NMS (authentication bypass, network-accessible)
• Honeywell Experion PKS (DCS, process safety impact)

Priority 2 — Apply mitigating controls immediately, patch within 90 days:

• Siemens Ruggedcom Crossbow (requires authentication for exploitation)
• Mitsubishi Electric MELSEC PLCs (network-accessible but DoS only)

Priority 3 — Assess and schedule:

• Siemens Industrial Edge Management (depends on edge platform criticality in your environment)
• Honeywell OneWireless Wireless Device Manager

Broader Context

The June 2026 ICS advisory cycle continues a pattern of accelerating disclosure in operational technology products. Key observations:

Convergence vulnerabilities: Several of this month’s advisories affect IT/OT convergence components — network management platforms, edge computing systems, wireless management tools. These components sit at the boundary between the IT and OT worlds and are often less rigorously managed from a security patch lifecycle perspective than either pure IT or pure OT systems.

Management plane risk: Siemens Sinec NMS and Ruggedcom Crossbow represent management plane attacks — compromising the tools used to monitor and manage industrial networks. Attackers who gain control of industrial network management have visibility and reach across the entire managed environment, making these components high-value targets disproportionate to their apparent criticality.

Action for asset owners: Review your OT asset inventory against the affected product versions in each advisory. If you are operating Experion PKS, MELSEC PLCs, or Sinec NMS, open advisory tracking with the relevant vendor security contacts and begin change management planning for the applicable remediation path.

Full advisory text for each of the vulnerabilities described is available through CISA’s ICS Advisory portal and the respective vendor security portals (Siemens ProductCERT, Honeywell Product Security, Mitsubishi Electric PSIRT).