As cited
Copy frozen at (site build).
ot ics
Eclipse Foundation Eclipse Milo
The Eclipse Foundation released a security advisory for Eclipse Milo versions 0.6.0 through 1.1.4 covering six vulnerabilities spanning authorization bypass, denial of service, credential exposure, and memory exhaustion. The vulnerabilities affect industrial control system (ICS) deployments in chemical, critical manufacturing, energy, water, and wastewater sectors. Eclipse Milo 1.1.5 addresses all issues, though users on version 0.6.x must migrate to 1.1.5 or later as no patched 0.6.x releases exist.
Why it matters: Organizations operating Eclipse Milo-based OPC UA servers in critical infrastructure must upgrade immediately: CVE-2026-62927, CVE-2026-58080, and CVE-2026-63248 allow unauthenticated attackers to bypass authorization and access protected data or methods, while CVE-2026-63252 and CVE-2026-61387 enable denial of service attacks, and CVE-2026-60007 permits password recovery through a padding oracle attack.
- Source published
- First seen by Cybersecurity Tracker