Eclipse Foundation Eclipse Milo
Plan PatchCVSS 8.2ICS-CERT ICSA-26-288-01Oct 15, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Eclipse Milo is an open-source OPC UA (OLE for Process Control Unified Architecture) server and client library used in industrial control systems. The vulnerability allows attackers to delete protected data, recover user credentials, impersonate legitimate users, or cause denial of service by making the server unresponsive to all clients. The issue affects versions 0.6.0 through 1.1.4.
What this means
What could happen
An attacker could compromise the OPC UA server by stealing credentials, impersonating authorized operators, deleting critical configuration or historical data, or crashing the server—disrupting communication with all connected PLCs, RTUs, and SCADA clients.
Who's at risk
Organizations using Eclipse Milo as an OPC UA server in industrial environments, including water treatment facilities, electric utilities, manufacturing plants, and any control systems that rely on OPC UA for SCADA communication and device integration. This affects both new deployments and legacy systems using older Milo versions.
How it could be exploited
An attacker with network access to the OPC UA server port can send specially crafted requests that exploit authentication or authorization flaws to gain unauthorized access, delete data, extract credentials, or trigger a denial-of-service condition. No user interaction or valid credentials are required for the initial exploit.
Prerequisites
- Network connectivity to the OPC UA server port (typically 4840)
- OPC UA server exposed to untrusted networks or accessible from an attacker-controlled host
remotely exploitableno authentication requiredlow complexityhigh impact (data deletion, credential theft, DoS)affects industrial communication servers
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Eclipse Milo: >=1.0.0|<=1.1.4≥ 1.0.0|≤ 1.1.4Fix available
Eclipse Milo: >=0.6.0|<=1.1.4≥ 0.6.0|≤ 1.1.4Fix available
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict network access to the OPC UA server port (default 4840) using firewall rules to allow only trusted engineering workstations, HMI servers, and authorized remote sites
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpgrade Eclipse Milo to version 1.1.5 or later as soon as possible within a scheduled maintenance window
Long-term hardening
0/2HARDENINGFor Milo 0.6.x deployments: evaluate migration plan to Milo 1.1.5 or later since no patched 0.6.x releases are available; use network segmentation as interim protection
HARDENINGSegment the OPC UA server onto a dedicated industrial network with restricted access from corporate networks and the Internet
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/5da1c064-1b84-4683-87a7-dc5609f0a42fGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.