ICS Patch Tuesday: 17 Siemens advisories, ArmorBlock fix
Siemens, Schneider Electric and Rockwell Automation have released their latest batch of industrial control system (ICS) security advisories. Siemens published the most, with 17 new advisories. Rockwell's single advisory covers a critical flaw that can lead to an admin account takeover on its 1732E ArmorBlock devices.
The releases land on the same day as Microsoft's October 2026 Patch Tuesday. Several industrial vendors use this monthly cycle to publish their own fixes.
Siemens: hundreds of flaws in Simatic CPUs
Patches are available for some of the vulnerabilities in Siemens' advisories. For the others, the company has shared mitigations that customers can use until permanent fixes are ready.
The critical-severity issues affect certain Simatic S7-1500 CPUs, Industrial Edge devices and the Ruggedcom Crossbow Station Access Controller (SAC). The Simatic CPU advisory is the largest. It covers more than 400 vulnerabilities in the GNU/Linux subsystem of the affected processors.
High-severity flaws were fixed across a long list of products:
- Ruggedcom Crossbow and Ruggedcom APE1808
- Simatic IPC and Simatic WinCC
- PSS(R)SINCAL
- the .NET Client Library for the Simatic S7 Webserver API
- Industrial Edge App Publisher
- Apogee, Desigo and Talon
Sentron 3NA COM Fuse and Capital Embedded AR Classic received patches for medium-severity issues. Siemens also told customers about a documentation ambiguity that affects Simatic S7 PLCs (programmable logic controllers) and related products.
Schneider Electric and Rockwell Automation
Schneider Electric published two advisories, and each describes one high-severity vulnerability.
The first affects Pro-face STW6000 and Harmony STW6. An attacker could take control of a device by getting the targeted user to visit a malicious webpage. The second affects Sage RTUs (remote terminal units). A privileged user could exploit it to install malicious firmware.
Rockwell Automation's advisory covers two vulnerabilities in 1732E ArmorBlock. The critical one lets an attacker change the device's web server password without authenticating first, which can result in takeover of the admin account. The second flaw can be used for denial of service (DoS).
CISA, CERT@VDE and other vendors
The US Cybersecurity and Infrastructure Security Agency (CISA) released two new ICS advisories on Tuesday. One describes vulnerabilities in Swann SWIFI-SE2KIC cameras that expose video information. The other covers a privilege escalation issue in Ignition, a product from Inductive Automation.
CERT@VDE, a German CERT focused on industrial automation, published one advisory. It describes an information disclosure vulnerability in Bender's Customer&Partner platform.
Other vendors released advisories between last month's Patch Tuesday and this one:
- Moxa: two severe vulnerabilities in protocol gateways
- Honeywell: Pro-Watch
- Hitachi Energy: Asset Suite, RTU500 and MicroSCADA
- Johnson Controls: ADVMS, Illustra Standard and EasyIO
- ABB: Automation Builder, Mint Workbench, AC500, Protection and Control IED Manager, Freelance and dynovaPRO
The dynovaPRO flaw could allow account takeovers through a bypass in the credential reset flow. ABB said it is not aware of exploitation in the wild, but it did find suspicious activity in its own logs.
"Internal log analysis identified 26 password change events affecting 9 customers, which may indicate testing or reconnaissance activity," the company said.
Organizations that run industrial equipment should keep a close eye on CISA and CERT@VDE, which publish ICS advisories regularly.
Our Take
Two flaws in this round are worth singling out, the Rockwell ArmorBlock password issue and the ABB dynovaPRO reset bypass. Both are authentication weaknesses that could hand an attacker an admin account. ABB's log findings suggest that someone may already have been probing its bypass, even though no attacks have been confirmed.
The 400+ flaws in the Simatic GNU/Linux subsystem point to a separate problem. Industrial hardware increasingly ships with general-purpose operating systems, and it brings their entire vulnerability backlog along. Plant operators are usually slow to patch, and some Siemens fixes are still pending, so the published mitigations will matter in the meantime.
The pressure on OT security policy is also growing. CISA has recently been urged to issue a binding OT security directive, and legacy equipment still limits visibility in many industrial networks. Readers should watch for reports of exploitation of the dynovaPRO and ArmorBlock flaws, and for when Siemens ships its remaining fixes.