CISA scored Toptech TMS7 a 10. Unauthenticated table export on a fuel terminal. The exploited box is a NetScaler.

25 September–2 October 2026. ICSA-26-272-02 puts TMS7 / TopHAT 7.6.3 at CVSS 10 — unauthenticated database export, PHP upload, five SQLi. Same window: Armatura One ships KEV’d ActiveMQ on a PACS, Monta charging-station impersonation 9.4 with no versioned flash, MikroTik RouterOS unauth root (CVE-2026-84411, 9.8), VIVOTEK camera command injection 10.0 with a public PoC. The KEV is Citrix NetScaler, then SD-WAN Manager, then FortiMail.

RWP Ventures · 2026-10-02 · 18 min read · priority 8.5

The finding that belongs at the top of an OT queue is not last week’s lwIP MQTT client. On 29 September CISA published ICSA-26-272-02 on Toptech TMS7 and TopHAT 7.6.3. Headline CVSS v3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) on CVE-2026-71379 (CWE-552). CISA’s summary sentence is the operator one: successful exploitation “could allow an attacker to access critical data or execute arbitrary code.” The file-export endpoint accepts a crafted POST from an unauthenticated caller and dumps arbitrary database tables. Same advisory, same build: CVE-2026-70356 unrestricted PHP upload (9.1, PR:H), five time-based blind SQLi at 9.0 (PR:H), session fixation, eval injection, XSS. Sectors on the page: Energy, Chemical, Transportation Systems. This is bulk-liquid terminal automation — loading racks, bills of lading, allocation — not a PLC rewrite and not a camera.

Vendor customers were told on 20 July 2026. The versioned fix is 7.8. Sachin Shetty and Roy Duisters (Shell CyberDefence) reported the set to Toptech and CISA. No known public exploitation.

Same CISA week, two other 9.x ICSAs that are not process control but will produce tickets:

• Armatura One (ICSA-26-274-01). Physical access-control / identity platform. Embeds Apache ActiveMQ with OpenWire on the network by default. That embed is CVE-2023-46604, CVSS 9.8, already on KEV for ransomware campaigns against other ActiveMQ deployments. CISA is not aware of exploitation specifically targeting Armatura One. Fixes: One → V4.7.2; One (USA) → V4.6.1_USA. Andrew Capobianco (RewCon.co) reported it.
• Monta monta.app (ICSA-26-274-02). EV charging cloud. CVE-2026-95102, CVSS 9.4, unauthenticated WebSocket impersonation of a charging station. Product version on the page is vers:all/*. Remediation is rolling OCPP 1.6 Security Profile 2 adoption and rate-limits, not a firmware string.

The only CONFIRMED in-the-wild activity with a 25 September–2 October timestamp that OT operators should treat as a live ticket is not a PLC. On 27 September CISA added CVE-2026-88771 / CVE-2026-88772 (Citrix NetScaler ADC/Gateway unauthenticated command execution / memory-buffer RCE) to KEV, federal due 30 September. That is a plant-VPN / ADC path. Cisco Catalyst SD-WAN Manager CVE-2026-76504 (KEV 30 September, due 3 October) is the WAN-controller analogue. FortiMail CVE-2026-104286 (KEV 1 October, due 4 October) is the mail-gateway analogue — and as of this morning the fixed FortiMail builds are still marked upcoming.

Do not upgrade this week’s ICSA pile into FrostyGoop. Last week’s live OT threat is unchanged: internet-reachable PLCs and engineering-client abuse named in AA26-097A and AA26-231A. CVE-2026-3869 on M580 / M580 Safety still has no CISA ICSA as of 2 October morning. Hitachi FACTS FCP/GWS still has no versioned patch in the 17 September ICSA.

OT threat posture

Exposure, engineering-path abuse, and now a KEV’d ADC remain higher confidence than novel ICS malware. Ransomware still hurts plants by killing the Windows, mail, and hypervisors OT depends on — vCenter CVE-2026-59310 remains KEV with ransomware Known; that is a hypervisor story, not a ladder-logic story. No public primary source this week documented a new ladder-logic change or a new ICS-specific wiper.

1. Most significant development

Toptech TMS7 / TopHAT CVE-2026-71379, because CISA scored unauthenticated network table-export 10.0 with changed scope on a named terminal-automation product used at energy, chemical, and bulk-liquid loading sites, and the same build also takes a high-priv PHP webshell.

Why this outranked the rest of the week: Armatura’s ActiveMQ 9.8 is the KEV-class component, but it is a PACS host, CISA explicitly does not claim Armatura-specific exploitation, and the remaining Armatura CVEs are local credential/crypto. Monta 9.4 is unauthenticated station impersonation on a charging cloud with no versioned flash — real for fleet EV, not a terminal rack. MikroTik CVE-2026-84411 is unauthenticated root on the web UI (9.8) and is a new ICSA, not last month’s RouterOS KEV pair; it is still an IT router. VIVOTEK CVE-2026-22755 is command injection scored 10.0 with a public PoC CISA attributed to indoushka — a plant-camera pivot, not a PAC. ABB PCM600 is the protection-engineering workstation and it is local 6.4 with workarounds only. Score for the week: 8.5. Armatura-as-lead would have been ~8.3 (KEV component, not process). NetScaler-only belongs in the IT briefing and in section 5 here.

2. Adversary / campaign activity

No new joint USG OT campaign advisory this week. Continuing, still the current hunt set:

• AA26-097A (April, updated 22 July): Iran-affiliated actors using Studio 5000 / EcoStruxure Control Expert / TIA Portal against internet PLCs (CompactLogix, Micro850, Modicon M340, S7-1200). CONFIRMED as USG. No new victim set this window.
• FBI/EPA 30 July water PSA: MicroLogix 1100/1400, seven states. CONFIRMED as PSA. Not this week’s news.
• AA26-231A (19 August): recon and capability development on US S7-200/300/400/1200 using internet scans and AI-generated “monitoring” scripts. CONFIRMED as USG wording. Now six weeks old. No new victim set this window.

CONFIRMED (non-ICS, this week): Citrix NetScaler CVE-2026-88771 / CVE-2026-88772, CISA KEV 27 September, federal due 30 September, forensic triage under BOD 26-04. Cisco Catalyst SD-WAN Manager CVE-2026-76504, KEV 30 September, due 3 October — unauthenticated admin via URI hex-encoding. FortiMail CVE-2026-104286, KEV 1 October, due 4 October — unauthenticated arbitrary file write; 8.0.2 / 7.6.7 / 7.4.9 still upcoming as of this morning’s Daily Top. SharePoint CVE-2026-65660, KEV 25 September. Apple CoreGraphics CVE-2026-86950, KEV 29 September, due today. WordPress Core CVE-2026-87902, KEV 25 September.

UNKNOWN a 25 September–2 October named victim with a confirmed ladder-logic, protection-setting, TMS7-database, Armatura-PACS, or charging-station-session change.

3. Vulnerabilities and active exploitation

CONFIRMED (CISA ICS, 29 September)

CONFIRMED (CISA ICS, 1 October)

CONFIRMED (active exploitation, not ICS): Citrix NetScaler CVE-2026-88771 / 88772, KEV 27 September, due 30 September. Cisco SD-WAN Manager CVE-2026-76504, KEV 30 September, due 3 October. FortiMail CVE-2026-104286, KEV 1 October, due 4 October, fixed builds still upcoming. SharePoint CVE-2026-65660, KEV 25 September. Apple CVE-2026-86950, KEV 29 September, due 2 October. WordPress CVE-2026-87902, KEV 25 September. Zyxel GS1900 CVE-2026-7273 and F5 APM CVE-2026-94127 remain last week’s edge KEVs. vCenter CVE-2026-59310 remains KEV with ransomware Known. MikroTik RouterOS CVE-2026-67277 / 86060 / 67279 remain the September edge-router hunt; CVE-2026-84411 is not on KEV as of this morning.

Still missing from CISA ICS: Schneider CVE-2026-3869 on M580 / M580 Safety. Three-week watch item. As of 2 October morning the ICS index still does not list it. Primary source remains SEVD-2026-251-04. Hitachi FACTS ICSA-26-260-03 still names no patched FCP version.

4. ICS / SCADA impact

No CONFIRMED new loss-of-view or loss-of-control event dated 25 September–2 October in CISA ICS, FBI/EPA, Toptech, Armatura, ABB, or Johnson Controls pages.

What would become process impact, if exploited on an exposed or poorly segmented box:

• TMS7 / TopHAT unauthenticated table export → bills of lading, allocation, driver/carrier records, and whatever else lives in those MariaDB tables, from a network that can POST to the export endpoint. PHP upload on the same host is how that becomes a webshell. This is terminal automation integrity, not a protection-element rewrite and not a PLC download.
• Armatura ActiveMQ OpenWire → code execution on the PACS / identity host, then control of doors, badges, and video integrations. That is physical-security compromise. It is not a PAC.
• Monta unauthenticated station session → administrative control or DoS of a charging station through the cloud WebSocket, not a substation IED.
• MikroTik 84411 → root on the plant-edge or contractor router. Pivot path. Not ICS malware.
• VIVOTEK command injection → root on a listed camera. Plant-camera VLAN pivot. Public PoC exists; CISA still says no known exploitation.
• Lantronix G520 signature-skip → replace gateway software, root on a cellular gateway used in water/energy/transport. AC:H UI:R.
• PCM600 Scheduler as LocalSystem → local privilege on the protection-engineering workstation that talks to IEDs. Attacker already has a logged-on PCM600 user. Path-traversal on project archives is a second local write. No versioned PCM600 in this ICSA.
• EasyIO Neo cleartext HTTP → credential capture on a building controller. 5.4 and 3.5. Not this week’s plant-floor incident.

Prior water PLC tampering (July) and the UK small-generator outage (late July, disclosed August) remain the last well-sourced availability hits. They are not this week’s news.

5. IT-to-OT exposure

Six doors this week, in the order operators can actually hunt:

1. Citrix NetScaler ADC/Gateway that is the plant, contractor, or jump-host VPN. CVE-2026-88771 / 88772 are unauthenticated, KEV 27 September, due 30 September. Forensic triage Yes. Due date was two days ago for FCEB. Inventory the role (Gateway / AAA / ICA) not the appliance checkbox. [28 September Daily Top](/posts/2026-09-28-citrix-netscaler-cve-2026-88771-88772-kev/).
2. Cisco Catalyst SD-WAN Manager that steers plant or backhaul overlays. CVE-2026-76504 is unauthenticated admin via URI hex-encoding, KEV 30 September, due 3 October. [1 October Daily Top](/posts/2026-10-01-cisco-sdwan-manager-cve-2026-76504-kev/).
3. FortiMail that handles plant or engineering mail. CVE-2026-104286, KEV 1 October, due 4 October. Unauthenticated file write. Workaround is IBE-off or management-off-internet; the ISOs are still upcoming. [2 October Daily Top](/posts/2026-10-02-fortimail-cve-2026-104286-kev/).
4. MikroTik RouterOS <7.24 on a plant, camera, or contractor VLAN. CVE-2026-84411 is a new unauthenticated-root ICSA, not last month’s KEV pair and not CVE-2026-67279. Patch to 7.24. Hunt management-port exposure separately from the older KEV rows.
5. Lantronix G520 cellular gateways in water/energy/transport. 2.6.0.7R6. Treat the update channel as untrusted until that build is on.
6. SharePoint / vCenter / Zyxel GS1900 / F5 APM from the last two weeks. SharePoint CVE-2026-65660 (KEV 25 September) is an IT code-injection row that becomes an OT outage when the farm holds procedures or drawings. vCenter CVE-2026-59310 remains the hypervisor outage. GS1900 and F5 APM OAuth remain last week’s edge tickets.

Ignition, engineering workstations, and internet-facing 44818/102/502/2222 remain the standing hunt from AA26-097A / AA26-231A. That hunt does not reset because CISA scored a terminal-management app 10.

6. Sector impact

• Electric / transmission: ABB PCM600 ≤2.14 is this week’s protection-engineering ticket — local, workarounds only, no versioned build in the ICSA. Last week’s Hitachi FACTS FCP with GWS is still the sector-specific 9.9 and still has no versioned firmware. Reyrolle 7SR5 V2.70 from three weeks ago is still the protection-relay ticket if that window slipped. AA26-231A S7 exposure is still the Siemens PLC lead.
• Oil and gas / chemical midstream / bulk liquid: TMS7 / TopHAT 7.6.3 → 7.8. If the export endpoint is reachable from an untrusted network, that is today’s isolation ticket, then the upgrade. AVEVA PIM 2025 SP1 P2 from 10 September is still open if project-file migration is not done.
• Process manufacturing: Armatura One off OpenWire and onto 4.7.2 / 4.6.1_USA if that PACS sits on a plant VLAN. Copy Fail on Unified HMI / IoT2050 / S7-1500 TM MFP remains last week’s unfixed-in-ICSA Siemens rows. lwIP MQTT is still a supplier letter.
• Building / commercial facilities: EasyIO Neo EC/CW to V3.3b64 / V3.3b26; HTTP off. Desigo CC V6/V7 from last week still has no fix. Siveillance OIS to the listed builds.
• Water / food / small SCADA: Lantronix G520 to 2.6.0.7R6. Last week’s mySCADA myPRO Manager 2.2 is still the unauthenticated-management ticket. OpenPLC v3 only if a lab actually runs it.
• Transportation / EV charging: Monta — require OCPP 1.6 Security Profile 2; do not treat vers:all/* as a firmware pull. Viidure is a dashcam with a public bucket and a non-responsive vendor. Last week’s Wärtsilä FOS-Onboard patch-via-vendor remains open.
• Physical security / cameras: Armatura One 4.7.2. VIVOTEK to current firmware; assume the public PoC works until the camera is patched. Anjvision and Meari have no vendor fix. Eufy / Botslab from last week stay consumer.

7. Defensive priorities

1. Internet-facing PLC eradication — still number one. VPN or jump host, never the controller. AA26-097A / AA26-231A have not been withdrawn.
2. TMS7 / TopHAT: if 7.6.3 (or anything pre-7.8) can be reached from an untrusted network, take the export and upload endpoints off that network today. Then upgrade to 7.8. Customer advisory is two months old; the ICSA is new.
3. NetScaler ADC/Gateway: due date was 30 September. Hunt, forensic-triage, patch. A “we’ll get to it next change window” ticket is late.
4. SD-WAN Manager: due 3 October. FortiMail: due 4 October, workaround now, ISO when Fortinet ships it.
5. Armatura One: inventory OpenWire listeners; upgrade to 4.7.2 / 4.6.1_USA; rotate the database superuser if it is still the vendor default.
6. MikroTik: 7.24 for CVE-2026-84411. Do not close the older RouterOS KEV rows because a new ICSA landed.
7. VIVOTEK: current firmware. Treat listed SKUs as command-injection-capable until patched. Public PoC is not the same as confirmed in-the-wild.
8. PCM600: apply the Scheduler-service logon workaround; do not wait for a PCM600 build this ICSA does not name. Keep project archives off untrusted shares.
9. EasyIO Neo to V3.3b64 / V3.3b26. Monta: authenticated OCPP only. Lantronix G520 to 2.6.0.7R6.
10. Hitachi FACTS GWS, mySCADA 2.2, Wärtsilä FOS-Onboard, IEM on-prem 1.15.20 / 2.2.2 / 2.9.1, and Desigo CC V6/V7 remain prior weeks’ open tickets. CVE-2026-3869 on M580 still has no ICSA — SEVD-2026-251-04 is still the primary.
11. Do not wait for ICS-specific malware. Dragos already told you ransomware did not need Stage 2.

8. What changed from last week

[Last week (ending 25 September)](/posts/2026-09-25-weekly-ot-lwip-iem-zyxel/) was CISA’s original lwIP work (commit-ID remediations, no product list), OpenPLC v3 EOL, and ICSAs stamped on Siemens ProductCERT notes from 8 and 16 September — IEM, Siveillance, SIMOVE/SIPLANT, Copy Fail, Desigo CC with no fix, WTV Web Access DoS. The exploited edge box was Zyxel GS1900, then F5 APM OAuth.

This week CISA’s original work is a named terminal-automation 10.0, a PACS with KEV’d ActiveMQ, an EV-charging cloud with no version string, a new MikroTik unauth-root ICSA that is not the September KEV, a VIVOTEK camera 10.0 with a public PoC, a local ABB protection-engineering workstation with workarounds only, and EasyIO Neo BMS firmware. 29 September also added three no-fix consumer/comms ICSAs (Anjvision, Viidure, Baicells) and a Lantronix cellular gateway. 1 October added Meari (no fix) and Malcolm Update A. No new Siemens ProductCERT ICSA this window. CVE-2026-3869 on M580 still has no ICSA. FACTS GWS still has no versioned patch. No new USG PLC campaign update. No new FBI/EPA water PSA. No new industrial-ransomware quarter. The exploited edge box moved from Zyxel / F5 APM (21–22 September) to NetScaler (27 September), with SD-WAN Manager on the 30th and FortiMail on 1 October. AA26-231A is six weeks old.

9. What OT defenders should watch next

Whether any TMS7 7.6.3 estate that was internet-reachable shows export-endpoint or PHP-upload abuse in web logs. Whether Armatura OpenWire listeners were reachable and whether CVE-2023-46604 exploitation against this embed is ever documented — it is not, today. Whether Monta’s rolling OCPP authentication actually deprecates the unauthenticated WebSocket or whether vers:all/* stays the page. Whether MikroTik 84411 is added to KEV, or stays an ICSA. Whether VIVOTEK’s public PoC is observed on industrial camera VLANs. Whether ABB publishes a PCM600 build that this ICSA does not name. Whether CISA finally republishes CVE-2026-3869. Whether Hitachi publishes a versioned FCP/GWS patch. Whether NetScaler or SD-WAN Manager compromise is observed on industrial access estates, not only enterprise campuses. Q3 industrial ransomware counts. Any AA26-097A or water-PSA refresh.

10. RWP assessment

High confidence: this week is CISA’s 29 September seven-pack plus 1 October six-pack — a named terminal-automation CVSS 10 with a two-month-old vendor fix, a PACS that shipped KEV’d ActiveMQ, an EV-charging cloud with no firmware train, a new MikroTik unauth-root ICSA, a camera 10.0 with a public PoC, and a local protection-engineering workstation with workarounds only. High confidence: exposed controllers and engineering paths in AA26-097A / AA26-231A remain the incident class that has evidence. High confidence: TMS7/TopHAT 7.6.3 with the export endpoint on an untrusted network is a 10.0 data-exfil until 7.8, and NetScaler due 30 September is late. Moderate confidence: a non-trivial bulk-liquid terminal estate is still on 7.6.3 because the July customer note did not become an ICSA until this week. Moderate confidence: NetScaler, SD-WAN Manager, and FortiMail are the IT-to-OT doors that will produce this week’s actual tickets. Low confidence: a new OT malware family dropped in the last seven days. Labeling a manufacturer ransomware victim, a NetScaler, an Armatura door controller, a Monta charging session, a VIVOTEK camera, or a Viidure dashcam as “OT compromise” without process evidence remains a briefing error.

This assessment covers 25 September–2 October 2026 and was published 2 October 2026.