ICS Patch Tuesday hit M580 Safety and Reyrolle. The exploited device this week is a MikroTik, not a PLC.

4–11 September 2026. Schneider CVE-2026-3869 on Modicon M580 and M580 Safety — firmware and application level both required. Siemens SSA-142885 Reyrolle 7SR5 session-ID exposure (CVE-2026-62645, CVSS 9.8) and Industrial Edge Management account takeover (CVE-2026-18963, 9.1). CISA KEV’d two MikroTik RouterOS bugs on 10 September; CERT.PL says the chain has been live since 2 September. No new Stage 2 ICS malware in public reporting this week.

RWP Ventures · 2026-09-11 · 12 min read · priority 8.6

On 8 September Schneider Electric posted SEVD-2026-251-04. CVE-2026-3869 is an incorrect authentication-algorithm implementation on Modicon M580 and Modicon M580 Safety. Schneider scores it CVSS v3.1 9.8 / v4.0 9.2. The vendor’s own words: failure to remediate “may risk establishing an unauthenticated connection” and “loss of confidentiality, integrity and availability of the PLC,” if a project with a lower application level is running. The fix is not a firmware flash by itself. M580 needs firmware 4.10 or above and application level 4.00 or above (Control Expert V15.2+). M580 Safety needs firmware 4.21 or above and application level 4.20 or above (Control Expert V16.0 with HF001). Teams that only bump firmware will still be on the vulnerable application level.

Same day, Siemens ProductCERT published SSA-142885 on Reyrolle 7SR5 protection relays before V2.70. CVE-2026-62645 (CVSS 9.8 / 9.3): the web interface exposes information that can be used to calculate current and past session IDs, which Siemens says can bypass authentication. That is a substation protection product, not a building-management footnote. SSA-503852 (CVE-2026-18963, CVSS 9.1) is an Industrial Edge Management password-reset bypass that lets an unauthenticated remote attacker take over accounts without completing email verification.

The only CONFIRMED in-the-wild activity with a 4–11 September timestamp that OT operators should treat as a live ticket is not a PLC. On 10 September CISA added CVE-2026-67277 and CVE-2026-86060 (MikroTik RouterOS) to KEV. CERT.PL and CCCS AL26-020: the MikroTrick chain has been used against internet-reachable SSH since at least 2 September. That is an edge-device compromise class. It is an IT-to-OT path where plants, water sites, and remote substations use MikroTik as CPE. It is not confirmation that a controller was reprogrammed.

Do not upgrade this week’s PSIRT stack into FrostyGoop. Last week’s live OT threat is unchanged: internet-reachable PLCs and engineering-client abuse named in AA26-097A and AA26-231A.

OT threat posture

Exposure, engineering-path abuse, and now a mass-exploited industrial-grade edge router remain higher confidence than novel ICS malware. Ransomware still hurts plants by killing the Windows and hypervisors OT depends on. No public primary source this week documented a new ladder-logic change or a new ICS-specific wiper.

1. Most significant development

Schneider CVE-2026-3869 on M580 / M580 Safety, because it is a PAC and a safety PAC, it is unauthenticated given the application-level condition, and the remediation will be missed by anyone who treats “flash firmware” as done.

Why this outranked the rest of the week: Reyrolle 7SR5 is as severe on paper (9.8 session calculation) and matters more to transmission/distribution protection engineers, but M580 Safety is the product class already in AA26-097A’s Schneider scope, and the dual firmware-plus-application-level control is an operational failure mode RWP can ticket this week. MikroTik is the exploited box — it is not an ICS product. AVEVA Pipeline Integrity Monitor (ICSA-26-253-01, 10 September) is midstream leak-detection software with a hardcoded key and MD5 password hashes; it is not process control. CareCam Pro (ICSA-26-251-01, 8 September) is a hard-coded bootloader credential requiring physical access. Score for the week: 8.6. Reyrolle-only would have been ~8.7 on severity and ~8.0 on defender actionability without the M580 dual-fix. MikroTik-only belongs in the IT briefing and in section 5 here.

2. Adversary / campaign activity

No new joint USG OT campaign advisory this week. Continuing, still the current hunt set:

• AA26-097A (April, updated 22 July): Iran-affiliated actors using Studio 5000 / EcoStruxure Control Expert / TIA Portal against internet PLCs (CompactLogix, Micro850, Modicon M340, S7-1200). CONFIRMED as USG. M580 Safety sitting on a low application level is now a same-family ticket, not a new attribution.
• FBI/EPA 30 July water PSA: MicroLogix 1100/1400, seven states, IP/password changes. CONFIRMED as PSA. Not this week’s news.
• AA26-231A (19 August): recon and capability development on US S7-200/300/400/1200 using internet scans and AI-generated “monitoring” scripts. CONFIRMED as USG wording. CSO Online (8 September) is implementation guidance — disable unused services only after proving they are unused — not a new victim set. Siemens’ position, as reported there, remains that AA26-231A describes methods against misconfiguration, not a new S7 CVE shared by every CPU.

CONFIRMED (non-ICS, this week): CERT.PL — attackers chaining MikroTik SSH bugs since at least 2 September, creating a privileged account named ops, source IPs reported as 82.192.72.4 and 103.102.31.18, log artifact user added by ssh:-2@. Help Net Security, citing Shadowserver, reported on the order of 122,500 MikroTik devices with SSH reachable in a 5 September scan window (reachability, not a vulnerability check).

UNKNOWN a 4–11 September named victim with a confirmed ladder-logic or safety-application change.

3. Vulnerabilities and active exploitation

**CONFIRMED (vendor advisory, 8 September — Schneider SEVD-2026-251-*)**

Schneider also revised four older Modicon notifications the same day (SEVD-2019-134-11 V14, SEVD-2023-010-06 V7, SEVD-2024-044-01 V5, SEVD-2024-317-02 V3), adding MC80 patch language. Those are 2018–2024 CVEs, not new 2026 exploitation.

As of 11 September morning, CISA’s ICS advisory index had not yet republished CVE-2026-3869 as an ICSA. Primary source remains Schneider PSIRT.

CONFIRMED (Siemens ProductCERT, 8 September)

• SSA-142885 Reyrolle 7SR5 < V2.70. Lead: CVE-2026-62645 session-ID calculation, CVSS 9.8. Also CVE-2026-62646/62647 (predictable session entropy), CVE-2026-62648/62649 (unauthenticated DoS), CVE-2026-62650 (RBAC bypass to admin from a low-priv web user), plus bundled Cesanta Mongoose issues. Fix: V2.70. These are feeder/overcurrent protection relays.
• SSA-503852 Industrial Edge Management, CVE-2026-18963, CVSS 9.1. Unauthenticated password reset without email verification (Keycloak reset-credentials flow). IEM Cloud: Siemens says firewall mitigation 26 August, fixed 2 September, no customer action. IEM Pro V1: ≥1.14.9 and <1.15.20 → 1.15.20. Pro V2: ≥2.2.0 and <2.2.2 → 2.2.2. Virtual: ≥2.6.0 and <2.9.1 → 2.9.1. Compensating control if you cannot patch: block /auth/realms/customer/login-actions/reset-credentials, or turn off “Forgot password” in the realm. That compensating control disables password reset.
• SSA-254516 Siveillance Control OIS web module: arbitrary file upload to root on the OIS server.
• SSA-517424 SIMOVE Fleetmanager / SIPLANT path traversal.
• SSA-330084 Desigo CC: client code execution via crafted graphics documents with embedded scripts.
• Updates, not new ICS bugs: SSA-328642 “Copy Fail” Linux kernel (CVE-2026-31431) rolled into more industrial products; OpenSSL and CodeMeter runtime follow-ons.

Canadian Centre AV26-890 (8 September) is a useful operator checklist of that Siemens set: Reyrolle 7SR5, Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, SIMOVE/SIPLANT.

CONFIRMED (CISA ICS, this window)

• ICSA-26-253-01 (10 September) AVEVA Pipeline Integrity Monitor ≤2025 SP1 P1 build 7.1.9580.8513. CVE-2026-81821 hard-coded cryptographic key (CVSS 8.4); CVE-2026-81822 weak (MD5) password hashes, admin elevation from project-file read; CVE-2026-81823 unauthenticated read of PIMBoards operations; CVE-2026-81824 XSS. Fix: 2025 SP1 P2 and one-way project-file migration and force password changes. Leftover backup .pim files are still the old crypto.
• ICSA-26-183-01 Update A (10 September) ST Engineering iDirect iQ-series satellite terminals ≤4.5.2.1, CVSS 8.8 — missing authentication / CSRF / info disclosure. Remote-site WAN, not a controller.
• ICSA-26-251-01 (8 September) CareCam Pro / ANJIA AJL33PC0801, CVE-2026-85083 hard-coded bootloader credential, AV:P. CISA: no known public exploitation, not remotely exploitable, vendor did not coordinate.

The 3 September CISA stack (Ignition, IXON VPN, Pyramid EtherNet/IP, Logix-adjacent ENBT/ArmorStart/ControlFLASH, OPC UA LDS, Tycon) is last week’s queue. It is not this week’s lead. See 7 September weekly OT.

CONFIRMED (active exploitation, not ICS): MikroTik RouterOS CVE-2026-67277 and CVE-2026-86060, CISA KEV 10 September. Fixed in 6.49.21 / 7.23.4 / 7.24.2. BOD 26-04 forensic-triage expectation applies to FCEB; industrial owners should still image before they wipe. Patching a router that already grew an ops account is not remediation.

NOT this week’s OT story: Cisco Secure FMC CVE-2026-20079 (KEV 9 September, federal due 12 September). It is a firewall-management root. It becomes an IT-to-OT path if that FMC manages the plant DMZ. That is the 10 September Daily Top, not a PLC advisory.

4. ICS / SCADA impact

No CONFIRMED new loss-of-view or loss-of-control event dated 4–11 September in CISA ICS, FBI/EPA, Schneider PSIRT, Siemens ProductCERT, or AVEVA’s PIM bulletin.

What would become process impact, if exploited on an exposed or poorly segmented box:

• M580 / M580 Safety unauthenticated connection → integrity of the PAC, including safety CPUs below application level 4.20.
• Reyrolle 7SR5 session bypass → protection-relay configuration and, in the worst case, protection function availability. Siemens’ own grid-security note on that advisory is the reminder that TSO/DSO protection is supposed to be multi-level redundant; that is architecture, not a patch.
• AVEVA PIM credential/key issues → leak-detection visibility and integrity of PIMBoards users, not pump-station PLC logic.
• IEM account takeover → apps and devices under that Industrial Edge Management plane.

Prior water PLC tampering (July) and the UK small-generator outage (late July, disclosed August) remain the last well-sourced availability hits. They are not this week’s news.

5. IT-to-OT exposure

Three doors this week, in the order operators can actually hunt:

1. MikroTik RouterOS with WAN SSH. Industrial parks, lift stations, and small substations buy these. Hunt: internet-facing 22/TCP on RouterOS banners; local user ops; log line user added by ssh:-2@; unexpected policy-mask changes. If you find ops, treat the device as owned — do not just upgrade. Then take SSH off the internet.
2. Industrial Edge Management and IXON-class remote access (IXON was 3 September; IEM is 8 September). Password-reset and VPN-client bugs are how a commodity IT session becomes a machine session without touching a coil.
3. Cisco FMC and other plant-DMZ managers (CVE-2026-20079). If FMC is how you push rules onto the OT firewall, root on FMC is root on the policy. Patch plus the Talos post-compromise clusters — see the Daily Top.

Ignition, engineering workstations, and internet-facing 44818/102/502/2222 remain the standing hunt from AA26-097A / AA26-231A. That hunt does not reset because Patch Tuesday landed.

6. Sector impact

• Electric / protection: Reyrolle 7SR5 is the sector-specific lead. AA26-231A S7 exposure is still the Siemens PLC lead. Do not conflate a protection-relay web UI with an S7-300 on port 102.
• Process manufacturing / water: M580 and M580 Safety. Water operators who still have MicroLogix on the internet have not finished July’s work; M580 application-level is additional.
• Distribution / MV-LV: PowerLogic T300 command injection — authenticated, but it is the RTU on the feeder.
• Oil and gas midstream: AVEVA PIM. Rotate PIMBoards passwords; migrate project files; lock down leftover backups. This is leak-detection integrity, not a claim that a pipeline PLC was written.
• Building / data center: Desigo CC CCE and EcoStruxure IT Data Center Expert. Winnipeg HVAC (August) is still the last well-sourced availability case in this class.
• Medical: ICSMA-26-253-01/02 (Mirth Connect, Orthanc) are CISA medical ICS, not plant OT.

7. Defensive priorities

1. Internet-facing PLC eradication — still number one. VPN or jump host, never the controller. AA26-097A / AA26-231A have not been withdrawn.
2. M580 / M580 Safety: confirm firmware and application level. Firmware 4.10/4.21 without application level 4.00/4.20 is not the Schneider fix.
3. Reyrolle 7SR5 to V2.70 on a maintenance window that protection engineering owns. Do not “disable the web server” as a clever shortcut until the protection engineer says that path is unused.
4. IEM Pro/Virtual to the trains in SSA-503852, or block the reset-credentials path and accept that password reset is off.
5. MikroTik: patch, then hunt ops / ssh:-2@. Pull WAN SSH. Image before wipe if the box sits in front of a plant or a lift station.
6. AVEVA PIM 2025 SP1 P2, migrate project files, rotate passwords, restrict read ACLs on old files.
7. Work last week’s 3 September ICSA pile if it is still in the queue: IXON, Ignition, then device firmware. Do not drop it because M580 arrived.
8. Do not wait for ICS-specific malware. Dragos Q2 already told you ransomware did not need Stage 2.

8. What changed from last week

Last week (ending 7 September) was CISA’s 1–3 September ICS stack — Logix CIP DoS CVE-2026-9637, Ignition, IXON, Pyramid EtherNet/IP — and no new Stage 2 malware. This week added vendor Patch Tuesday: Schneider M580 Safety auth, Siemens Reyrolle and IEM, AVEVA PIM via CISA on the 10th, and a KEV on MikroTik that is actually being exploited. No new USG PLC campaign update. No new FBI/EPA water PSA. No new industrial-ransomware quarter. AA26-231A is 23 days old; the new public text is CSO’s 8 September implementation note, not a new victim.

9. What OT defenders should watch next

Whether CISA republishes CVE-2026-3869 as an ICSA — that will drive the federal/contractor ticket even though Schneider already shipped the fix. Whether Reyrolle 7SR5 or IEM CVE-2026-18963 grows an in-the-wild note. Whether MikroTik ops shows up in industrial ASN space, not just consumer CPE. Q3 industrial ransomware counts. Any AA26-097A or water-PSA refresh.

10. RWP assessment

High confidence: this week is ICS Patch Tuesday hygiene plus an exploited edge router. High confidence: exposed controllers and engineering paths in AA26-097A / AA26-231A remain the incident class that has evidence. High confidence: flashing M580 firmware without raising application level leaves CVE-2026-3869 open. Moderate confidence: a non-trivial number of industrial WAN edges are MikroTik with SSH on the internet; CERT.PL’s ops artifact is the hunt, not a plant-floor IOC. Low confidence: a new OT malware family dropped in the last seven days. Labeling a manufacturer ransomware victim, or a MikroTik CPE, as “OT compromise” without process evidence remains a briefing error.

This assessment covers 4–11 September 2026 and was published 11 September 2026.