Updated just now · 98 advisories
An attacker could compromise the OPC UA server by stealing credentials, impersonating authorized operators, deleting critical configuration or historical data, or crashing the server—disrupting communication with all connected PLCs, RTUs, and SCADA clients.
An attacker could gain full control of EseeCloud IP cameras, potentially disabling surveillance, manipulating video feeds, or using compromised cameras as a pivot point to attack other systems on your network.
An attacker with valid credentials could read sensitive files from your Torrent Server, potentially exposing sequencing data, analysis results, or system configuration details stored on the server.
An attacker with network access could delete medical images from your archive, expose patient information, forge or modify patient studies, reassign medical records between patients, and disrupt the availability of your imaging system. This compromises patient safety, privacy, and the integrity of medical records.
An attacker with local access and low privileges could fill the system's temporary storage with XML conversion files, causing the system to stop responding or become unavailable. This could interrupt control operations and require manual intervention to restore service.
An authenticated local user with access to the Software Center workstation could execute arbitrary code with administrative privileges, potentially compromising engineering functions or disrupting device management across your automation infrastructure.
This is an advance notification only; no vulnerabilities have been disclosed yet. On October 21, 2026, Cisco will publish security advisories affecting routers, security appliances, and collaboration products. Specific impact cannot be assessed until the actual vulnerabilities are disclosed.
A local attacker with low privileges on a Windows machine running GlobalProtect can crash the VPN client, interrupting secure access to your network and potentially disrupting remote work or field operations until the service is restarted.
A local user on macOS could gain administrative control of their machine and potentially compromise any VPN connections or sensitive data the organization relies on through that endpoint. This could enable lateral movement to network resources if the compromised machine is used to access critical infrastructure or control systems.
A malicious administrator could inject malicious JavaScript into the firewall's web management interface, potentially compromising other administrators' sessions or stealing their credentials when they log in.
An authenticated read-only administrator could crash the PAN-OS management interface with a crafted API request, temporarily disrupting access to firewall configuration and monitoring but not affecting active traffic forwarding.
An attacker could crash your Panorama management appliance, forcing it into maintenance mode and preventing you from managing your Palo Alto firewalls across your network until the system is recovered.
An authenticated user can hijack another user's GlobalProtect remote access session, allowing them to access network resources and systems using a compromised identity. This could enable lateral movement within your network and unauthorized access to sensitive infrastructure.
An authenticated admin with access to the management interface can execute arbitrary commands as root on the firewall, potentially disrupting network traffic filtering, exfiltrating configuration data, or altering security policies. This affects all PA-Series, VM-Series firewalls and Panorama.
An unauthenticated attacker can send malicious network packets through your firewall to trigger a denial of service, forcing the device into maintenance mode and blocking all network traffic until manual intervention.
An authenticated attacker who can reach your firewall's management interface could run commands with root-level access, potentially disrupting network traffic filtering, modifying security policies, or causing the firewall to stop functioning.
An attacker with network access to a 1732E ArmorBlock could execute arbitrary code on the device, potentially allowing them to intercept, modify, or disable encrypted communications between control systems and field devices, disrupting plant operations.
A user with local access to a Windows DNS server could tamper with DNS configuration or records, potentially redirecting traffic to attacker-controlled servers or disrupting name resolution for critical services in your network.
Requires local access — could expose sensitive process data
Requires local access — could allow full system takeover
Requires local access — could allow unauthorized configuration changes
Remotely exploitable — could allow full system takeover
A user with standard access to a Windows workstation or server could exploit this vulnerability to gain full administrative control over that device, potentially allowing them to modify SCADA software, access sensitive process data, or disrupt operations.
Remotely exploitable — could cause loss of control or denial of service — no credentials needed
Remotely exploitable — could allow full system takeover — no credentials needed
A user with local logon access could exploit a buffer overflow in NTFS to gain system-level privileges, allowing them to bypass access controls and modify critical files or settings on the computer.
An attacker could run arbitrary commands on your engineering workstations or HMI systems via Remote Desktop Protocol, potentially allowing them to modify process setpoints, access historian data, or disrupt local operations.
Remotely exploitable — could allow unauthorized configuration changes — no credentials needed
An attacker could execute arbitrary code on a Windows workstation or server running Remote Desktop Client by sending a malicious network packet, potentially gaining full control of the machine and any systems it can access on your network.
An attacker could execute arbitrary code on a Windows system running Remote Desktop Client by sending a specially crafted RDP message, potentially allowing them to run commands, access sensitive data, or disrupt the system.
An attacker could execute arbitrary code on Windows computers running Remote Desktop Client, potentially compromising operator workstations that manage critical infrastructure such as SCADA systems or PLCs.
An attacker could execute commands on a Windows system running Remote Desktop Services without authentication, potentially allowing them to control the machine, access sensitive data, or disrupt critical operations in facilities that rely on Windows servers for process control or SCADA integration.
An attacker could execute arbitrary code on an operator workstation or server running Remote Desktop Client, potentially compromising the system and any connected SCADA/HMI systems or networks it can access.
An attacker could run arbitrary code on engineering workstations or operator terminals used for remote management of control systems. This could allow them to intercept, modify, or block communications to PLCs and other devices.
An attacker with local access to a Windows system could read sensitive kernel memory that should be restricted, potentially exposing credentials or system configuration details. This is a local information disclosure only—no remote access or system compromise.