CERT-FR added Copeland and Dixell to the fridge campaign. Siemens Patch Tuesday is Crossbow and an S7 web server with no fix.

9–16 October 2026. CERTFR-2026-ALE-012 revised 13 Oct — Danfoss AK-SM/AK-SC plus Copeland xweb and Dixell xweb, campaigns still running, factory-reset on EOL is not the close. Same week: Siemens Crossbow V6.0, S7-1500 web SSA-591731 9.6 with no firmware, Industrial Edge 9.1, WinCC 8.8. Rockwell ArmorBlock 3.013. Schneider Sage RTU C3414-500-S02L0; Pro-face STW6000 no patch. CISA: Ignition 8.1.55 / 8.3.9, Eclipse Milo 1.1.5, EseeCloud no vendor. Edge KEVs are Ivanti and PAN-OS, not a PLC.

RWP Ventures · 2026-10-16 · 22 min read · priority 9.2

The finding that belongs at the top of a food, grocery, and cold-store queue is not last week’s RTU500. On 13 October CERT-FR revised CERTFR-2026-ALE-012. The 12 October text named Danfoss AK-SM and AK-SC. The 13 October revision adds Copeland xweb and Dixell xweb. The sentence is still “numerous compromises.” Risk in the bulletin is still “non spécifié par l’éditeur.” CERT-FR now says attack campaigns against these boxes are probably still running, that internet exposure of an EOL unit is a high-probability recompromise, and that a factory reset alone is not the close — persistence is gone, the hole is not. No CVE in the alert. [13 October Daily Top](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/) covered the 12 October Danfoss-only version; this weekly is the 13 October product-class expansion, not a reprint.

Do not collapse four facts. Overnight 11–12 October French grocers lost cold chain — that is OT process impact, CONFIRMED by named operators and by CERT-FR’s product class. Danfoss told Cooling Post most of the hit fleet is already EOL (AK-SM800 May 2021, AK-SC355 phased 2016) plus some current AK-SM800A on old firmware. CERT-FR did not name CVE-2025-41450 / 41451; those remain 800A background, not this weekend’s confirmed exploit path. Ahold Delhaize remains a separate IT containment.

Tuesday’s industrial Patch Tuesday is a different ticket. Siemens ProductCERT dated 13 October published a 17-advisory pack plus updates. The energy remote-access 8.8 is SSA-508506 RUGGEDCOM CROSSBOW all versions < V6.0 — eleven CVEs, SQLi and authorization failures, authenticated (PR:L), fix V6.0. Do not brief the same-day SAC header 9.8 as unauthenticated takeover of the Station Access Controller; SSA-765416 is integrated SQLite, and the 9.8 row is CVE-2025-71316 on sqldiff.exe DLL load. The S7-1500 finding with no firmware is SSA-591731: eight web-server CVEs (CVE-2026-63350 through 63357), CVSS 3.1 9.6, XSS in an authorized user’s browser then PLC operations within that user’s authorization. Siemens: currently no fix. Industrial Edge path traversal SSA-832641 is 9.1 (CVE-2026-44414); IECD/IEOD/IEVD floor V1.28.1; SCALANCE LPE and Unified Comfort HMI no fix. WinCC SSA-550198 CVE-2026-59241 8.8 authenticated database-role RCE; V8.0 Update 11 / V8.1 Update 7; V7.5 no fix.

Rockwell SD1801, same day: 1732E ArmorBlock I/O. CVE-2026-12655 unauthenticated webserver password change, vendor CVSS 3.1 9.1 / 4.0 8.8, CWE-294. CVE-2026-12656 network-storm DoS, 7.5 / 8.7, power-cycle to recover. Affected 3.012 and earlier. Close: 3.013. Internal find. Not on KEV.

Schneider the same Tuesday: SEVD-2026-286-02 CVE-2026-102250 Sage RTU 1410/1430/1450/2400/3030 Magnum/4400 prior to C3414-500-S02L0 — insufficient firmware authenticity, privileged admin starts the update. SEVD-2026-286-01 CVE-2026-96434 Pro-face STW6000 / Harmony STW6 all versions, unmaintained third-party component, no patch. Canada republished Sage as AV26-1051 on 15 October.

CISA’s original ICS work this window is 13 October Ignition and Swann, then 15 October Malcolm, Eclipse Milo, EseeCloud, plus N-Tron 700 Update A (CVSS v4 and broken links — last week’s switch, not a new finding). Ignition ICSA-26-286-01 CVE-2026-92817 8.8: authenticated Vision session identifier → Designer-level privileges → code in the Gateway process. Floors 8.1.55 / 8.3.9. Eclipse Milo ICSA-26-288-01 header 8.2, mixed-batch Call auth bypass CVE-2026-62927, unauth chunk-leak DoS CVE-2026-63252; fix 1.1.5; 0.6.x has no patched train. EseeCloud ICSA-26-288-02 hardcoded credential CVE-2026-107617 9.8 plus owner-rebind CVE-2026-97858; vendor did not respond. Malcolm ICSA-26-280-01 is CISA’s own ICS sensor, header 8.1, Arkime X-Forwarded-User and kiosk CSRF-to-wipe; first published 7 October, Update A 15 October. Swann is local unauthenticated video, CISA: not remotely exploitable.

The only CONFIRMED in-the-wild tickets with a 9–16 October KEV timestamp that OT operators should treat as live IT-to-OT doors are not PLCs. Catalog freeze this morning: 2026.10.15 / 1746. New rows: Ivanti Connect Secure CVE-2026-104935 (13 Oct, due 16 October), Windows Shell CVE-2026-96951, PAN-OS CVE-2026-0322 (authenticated), AhsayCBS CVE-2026-105133 / 105134, Cisco SEG CVE-2026-76519, Atlassian CVE-2026-21589. [14 October Daily Top](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/) on UTA0576. [16 October Daily Top](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/) on ARMORY CASTLE. None of those are ICS malware.

Do not upgrade this week’s Siemens pack or ArmorBlock into FrostyGoop. Last week’s live OT threat set is unchanged except the fridge campaign: internet-reachable PLCs and engineering-client abuse named in AA26-097A and AA26-231A. CVE-2026-3869 on M580 / M580 Safety still has no CISA ICSA as of 16 October morning; SEVD-2026-251-04 remains the primary. Hitachi FACTS FCP/GWS still has no versioned patch in the 17 September ICSA.

OT threat posture

A refrigeration system manager with a public management UI produced CONFIRMED process impact this window. That is a higher-confidence OT incident class than any of Tuesday’s CVSS 9.x rows, which CISA and the vendors still tag with no known public exploitation. Exposure, engineering-path abuse, and a KEV’d plant VPN remain the standing hunt. Ransomware still hurts plants by killing the Windows, mail, and hypervisors OT depends on. Integrity Tech from last week is still email, credentials, leftover Appendix B, and SoftEther — CONFIRMED as CNE against IT that critical-infrastructure operators run, not confirmed as a process write. No public primary source this week documented a new ladder-logic change or a new ICS-specific wiper.

1. Most significant development

CERT-FR’s 13 October revision of CERTFR-2026-ALE-012, because a national CSIRT moved a confirmed cold-chain compromise from one OEM’s system manager to a product class (Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb), said the campaign is probably still running, and told operators that factory-reset on an internet-facing EOL box is not remediation.

Why this outranked the rest of the week: Siemens Crossbow 8.8 is the Tuesday energy remote-access ticket — authenticated SQLi on a NERC CIP IED access manager, versioned V6.0 the same day — and it would have been the lead in a week without a process event. It is still a jump-host/IED broker, not a defrost clock. SSA-591731 9.6 is the S7-1500 web-server finding with no firmware; it is XSS in a logged-on session, not unauthenticated logic download, and Siemens has not shipped a close. ArmorBlock 9.1 is an on-machine I/O web password, versioned 3.013. Ignition 8.8 is authenticated Vision→Designer. EseeCloud 9.8 is a camera cloud with a silent vendor. Score for the week: 9.2. Crossbow-as-lead would have been ~8.4 (8.8, energy remote access, versioned V6.0, no exploitation). S7-web-as-lead would have been ~8.3 (9.6, no fix, still UI-in-session). ArmorBlock-as-lead ~7.9. The 13 October Daily Top already scored Danfoss 9.3 as a single-day story; this weekly is the class expansion, not a second 9.3 on the same 12 October paragraph.

2. Adversary / campaign activity

CONFIRMED (this window, OT process): CERTFR-2026-ALE-012. First version 12 October (Danfoss AK-SM / AK-SC). Revision 13 October adds Copeland xweb and Dixell xweb. CERT-FR: numerous compromises; management interface on the internet contrary to good practice; if not compromised, pull public IP and restore only via VPN or filtered contractor addresses; if compromised, factory reset then rebuild, firmware where it still exists, Strict mode, rotate defaults. Explicit warning: campaigns probably still in progress; EOL internet exposure is a recompromise bet; reset without removing the hole is insufficient. Named actor: none. CVE in the alert: none. Extra-France victims of this night: UNKNOWN until another CSIRT publishes. Independent temperature that does not ride the same controller remains the detection that survives a hostile setpoint.

CONFIRMED (this window, not ICS malware): Integrity Tech AA26-281A remains last week’s USG story. Five Appendix B KEV rows were due 11 October. SoftEther named conhost.exe / dllhost.exe and EBurst against Exchange are still the hunt. A scanned power company is still not a PLC write.

Continuing, still the current hunt set:

• AA26-097A (April, updated 22 July): Iran-affiliated actors using Studio 5000 / EcoStruxure Control Expert / TIA Portal against internet PLCs (CompactLogix, Micro850, Modicon M340, S7-1200). CONFIRMED as USG. No new victim set this window.
• FBI/EPA 30 July water PSA: MicroLogix 1100/1400, seven states. CONFIRMED as PSA. Not this week’s news.
• AA26-231A (19 August): recon and capability development on US S7-200/300/400/1200. CONFIRMED as USG wording. Now eight weeks old. No new victim set this window.

CONFIRMED (non-ICS, this week): Ivanti Connect Secure CVE-2026-104935, KEV 13 October, federal due 16 October, Volexity UTA0576 on patched boxes — rebuild, do not “upgrade in place.” PAN-OS CVE-2026-0322, authenticated code injection, KEV 14 October, due 17 October. AhsayCBS 105133/105134, due 17 October. Cisco SEG 76519, due 17 October. Atlassian 21589, due 18 October. BeyondTrust CVE-2026-102764 ARMORY CASTLE, 16 October Daily Top. FortiBleed admin lockouts and GlobalProtect cookie Settra remain from the [12 October weekly IT](/posts/2026-10-12-weekly-it-session-kill-fortibleed-ahsay-netscaler/).

UNKNOWN a 9–16 October named victim with a confirmed ladder-logic, protection-setting, Crossbow-config, ArmorBlock-password, or Ignition-Designer change outside the French refrigeration event.

3. Vulnerabilities and active exploitation

CONFIRMED (CERT-FR, 12–13 October) — process event, no CVE.

CONFIRMED (Siemens ProductCERT, 13 October) — selected, not the entire 17-pack.

GNU/Linux-subsystem updates on S7-1500 TM MFP and CPU 1518(F)-4 PN/DP MFP (SSA-794697, 784472, 457936, 398330, 265688, 082556, 019113 and related) are the same-day Linux-in-the-PLC pile. Treat them as the coprocessor/Linux personality, not as a new S7comm write. RUGGEDCOM APE1808 again carries PAN-OS and FortiGate NGFW rows (SSA-967325, 864900, 127084, 104023) — those are the firewall image on the industrial PC, patched as the firewall vendor’s train.

CONFIRMED (Rockwell, 13 October)

CONFIRMED (Schneider CPCERT, 13 October)

CONFIRMED (CISA ICS, 13 and 15 October)

ICSMA-26-288-01 Thermo Fisher Torrent Suite and ICSMA-26-288-02 J4Care dcm4che are medical. They are on the 15 October CISA list. They are not this briefing’s plant-floor lead.

CONFIRMED (active exploitation, not ICS): KEV freeze 2026.10.15 / 1746. Ivanti 104935 due today, 16 October. PAN-OS 0322 due 17 October (PR:L — do not brief it as unauth). Ahsay 105133/105134 due 17 October. Cisco SEG 76519 due 17 October. Atlassian 21589 due 18 October. Last week’s Integrity Tech five-pack was due 11 October. FortiBleed still has no CVE. NetScaler 88779 / 107406 remain the ADC hunt. No Danfoss, Copeland, Dixell, Crossbow, ArmorBlock, Ignition, Milo, or Sage CVE is on that catalog this morning.

Still missing from CISA ICS: Schneider CVE-2026-3869 on M580 / M580 Safety. Five-week watch item. As of 16 October morning the ICS index still does not list it. Primary remains SEVD-2026-251-04. Hitachi FACTS ICSA-26-260-03 still names no patched FCP version.

4. ICS / SCADA impact

CONFIRMED process impact this window: French grocery refrigeration — defrost/setpoint abuse, spoiled stock, named banners. CERT-FR product class is the remote system manager, not the grocer’s SAP. Store census remains REPORTED. Fires as a universal cyber effect remain prosecutor/press, not CERT-FR.

No CONFIRMED new loss-of-view or loss-of-control event dated 9–16 October in Siemens ProductCERT, Rockwell SD1801, Schneider SEVD-2026-286, or CISA ICS for Crossbow, S7-1500 web, ArmorBlock, Sage, Ignition, or Milo.

What would become process impact, if exploited on an exposed or poorly segmented box:

• CERT-FR class → hostile defrost / setpoint / alarm path on the case controller. That already happened in France. Copeland xweb and Dixell xweb are now in the same CSIRT sentence as Danfoss.
• CROSSBOW 89196–89206 → authenticated SQL and unauthorized special operations on the IED access broker. That is who can talk to field IEDs, not a confirmed breaker operation.
• S7-1500 web 63350–63357 → actions the logged-on user was already allowed to take, driven from their browser. Restrict the web server. It is not snap7-from-the-WAN.
• ArmorBlock 12655 → admin of the on-machine I/O web UI, config change. 12656 → availability until power-cycle. Neither is CompactLogix ladder.
• Sage 102250 → modified firmware after an admin starts the update. Privileged, not anonymous.
• Ignition 92817 → Gateway-process code from a Vision user. SCADA host, not a safety PLC.
• Milo 62927 → denied OPC UA method in a mixed Call batch. Stack component; vendor letter for 1.1.5.
• Malcolm 107337 → --wipe of captured traffic via kiosk CSRF. You lose the sensor, not the plant.
• Integrity Tech / Ivanti / FortiBleed against a utility jump host → IT compromise at an industrial company. ASSESSED IT-to-OT path. Not a process event in those CSAs.

Prior water PLC tampering (July) and the UK small-generator outage (late July, disclosed August) remain the last well-sourced availability hits before this fridge week. They are not this week’s news.

5. IT-to-OT exposure

Seven doors this week, in the order operators can actually hunt:

1. Internet-facing refrigeration system managers — Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb. CERT-FR’s close: public IP off; VPN or filtered contractor; if compromise is plausible, factory reset and remove the hole. EOL boxes do not get a hotfix. Independent probe temperature. [13 October Daily Top](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/).
2. Ivanti Connect Secure that is the plant, contractor, or jump-host VPN. CVE-2026-104935 due 16 October. Volexity UTA0576 on boxes that were already patched. Rebuild. [14 October Daily Top](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/).
3. PAN-OS / GlobalProtect that still holds a stolen cookie. CVE-2026-0322 is authenticated and KEV’d 14 October. CVE-2026-0257 Settra remains the session-kill from 12 October. FortiBleed lockouts still have no CVE.
4. CROSSBOW / SAC that brokers IED access. V6.0. Treat leftover SQLite tooling scores separately from the SQLi that is actually in the product.
5. Ignition Gateway with Vision users. 8.1.55 / 8.3.9. A Vision session ID is not a Designer entitlement.
6. NetScaler ADC/Gateway and AhsayCBS that back up the engineering VLAN. 107406 still does not retire 14.1-73.41. Ahsay 10.3.4 was walked back; 105134 is KEV.
7. BeyondTrust / Cisco SEG / Atlassian that sit on a path to engineering. ARMORY CASTLE and SEG 76519 are IT tickets until logs show a process write.

Ignition, engineering workstations, and internet-facing 44818/102/502/2222 remain the standing hunt from AA26-097A / AA26-231A. That hunt does not reset because CERT-FR named a fridge controller.

6. Sector impact

• Food / grocery / cold-store 3PL: CERT-FR class first. Inventory AK-SM, AK-SC, Copeland xweb, Dixell xweb, contractor VPN, and every public 80/443 on a refrigeration banner. EOL replace, not patch. Independent temperature. Ahold IT is a parallel ticket if you are that grocer, not this CVE class.
• Electric / transmission: CROSSBOW / SAC to V6.0. S7-1500 web server off the WAN until SSA-591731 ships firmware. APE1808 firewall image as the PAN-OS/FortiGate train, not as a Siemens PLC. Last week’s RTU500 11.x isolate-and-migrate (12.7.8 / 13.9.1) and openPDC 2.9.482 / openHistorian 2.8.585 are still open. FACTS FCP/GWS still has no versioned firmware. AA26-231A S7 exposure is still the Siemens PLC lead.
• Oil and gas / chemical midstream: Sage RTU to C3414-500-S02L0. CROSSBOW if that is the IED broker. Last week’s TMS7 / TopHAT 7.8 is still the terminal-automation close.
• Process manufacturing: ArmorBlock 3.013. Ignition 8.1.55 / 8.3.9. Milo 1.1.5 if that stack is in a gateway. S7-1500 TM MFP / 1518 MFP Linux-subsystem SSAs as the coprocessor pile. Copy Fail on Unified HMI / IoT2050 / S7-1500 TM MFP remains the unfixed-in-ICSA Siemens row from September.
• Building / commercial facilities: Pro-face STW6000 / Harmony STW6 — no patch, isolate. APOGEE/Desigo SSA-333035: PXC to 3.5.7 / 2.8.21 where it exists; MBC/MEC no fix. Last week’s EasyIO FG remains isolate-and-migrate. Desigo CC V6/V7 from September still has no fix.
• Water / small SCADA: Malcolm if you run CISA’s sensor — 107336 is v26.08.0, 107333/107362 are still listed through that build. Milo 1.1.5. Last week’s lwIP SMTP vendor letter and Lantronix G520 remain open. Ivanti against a utility VPN is an IT ticket until logs show a process write.
• Physical security / cameras: EseeCloud 9.8, vendor silent — assume unpatchable, pull from any plant VLAN. Swann is local, 6.2, not a control-system finding. Last week’s Armatura One and VIVOTEK remain the PACS/camera tickets.

7. Defensive priorities

1. Refrigeration UIs off the internet — CERT-FR order, not a CVE wait. Danfoss, Copeland xweb, Dixell xweb. Factory reset plus remove the hole. EOL is replace.
2. Internet-facing PLC eradication — still number two only because a process event outranked it this week. VPN or jump host, never the controller. AA26-097A / AA26-231A have not been withdrawn.
3. Ivanti Connect Secure 104935 due 16 October. Rebuild if UTA0576 conditions match. PAN-OS 0322 due 17 October. FortiBleed: ISO plus session hunt.
4. CROSSBOW / SAC V6.0. Do not merge the SQLite 9.8 into the product SQLi.
5. S7-1500 web server: restrict until SSA-591731 ships. Do not wait for a firmware that is not in the advisory.
6. ArmorBlock 3.013; web UI off the cell VLAN.
7. Ignition 8.1.55 / 8.3.9. Sage RTU C3414-500-S02L0. Pro-face: isolate, no patch.
8. WinCC 8.0 U11 / 8.1 U7. Industrial Edge V1.28.1. IPC BIOS floors in SSA-159454, then reload defaults and re-provision Secure Boot keys.
9. Milo 1.1.5. Malcolm past v26.08.0 for the RBAC/SSRF pair. EseeCloud: treat as unpatchable until the vendor answers CISA.
10. Open from prior weeks: RTU500 12.7.8 / 13.9.1, openPDC 2.9.482, N-Tron 3.11.1, TMS7 7.8, Armatura One 4.7.2, MikroTik 7.24 (CVE-2026-84411, still not KEV), FACTS GWS (no versioned patch), M580 SEVD-2026-251-04 (still no ICSA), mySCADA 2.2, Wärtsilä FOS-Onboard, Desigo CC V6/V7.
11. Do not wait for ICS-specific malware. This week’s process loss did not need a named wiper.

8. What changed from last week

[Last week (ending 9 October)](/posts/2026-10-09-weekly-ot-rtu500-openpdc-integrity/) was CISA’s 6 October Hitachi/lwIP/EasyIO pack plus 8 October GPA/Red Lion/Satel pack — an EOL energy RTU with unauthenticated firmware, a 9.8 on openPDC when Windows Authentication is off, and Integrity Tech as IT-to-OT positioning.

This week the original OT work is a French CSIRT process event that grew from Danfoss to Copeland and Dixell on 13 October, Siemens Patch Tuesday (Crossbow V6.0, S7-1500 web with no fix, Industrial Edge 9.1, WinCC 8.8, IPC Secure Boot test key), Rockwell ArmorBlock 3.013, Schneider Sage RTU with a versioned floor and Pro-face with none, and CISA’s Ignition / Milo / EseeCloud / Malcolm set. N-Tron Update A is housekeeping. No new USG PLC campaign update. No new FBI/EPA water PSA. CVE-2026-3869 on M580 still has no ICSA. FACTS GWS still has no versioned patch. The exploited activity moved from Integrity Tech’s five-pack due 11 October to Ivanti 104935 due 16 October, with FortiBleed lockouts and the GlobalProtect cookie still in the IT weekly. AA26-231A is eight weeks old.

9. What OT defenders should watch next

Whether CERT-FR revises ALE-012 with a CVE, a firmware floor, or a non-French CSIRT joint — and whether Copeland or Dixell publish a numbered PSIRT that names a current package as the close. Whether CISA adds a Danfoss/Copeland row to KEV or reopens ICSA-25-140-03. Whether extra-France CSIRTs report the same night as separate evidence. Whether Siemens ships SSA-591731 firmware, or operators just leave the S7 web server off. Whether CROSSBOW V6.0 actually lands on utility jump paths. Whether ArmorBlock 12655 is observed on a cell VLAN. Whether Ignition 92817 is seen without a Designer license. Whether Guangzhou Juan answers CISA on EseeCloud. Whether CISA finally republishes CVE-2026-3869. Whether Hitachi publishes a versioned FCP/GWS patch. Q3 industrial ransomware counts. Any AA26-097A or water-PSA refresh.

10. RWP assessment

High confidence: this week’s OT lead is CERTFR-2026-ALE-012 as revised 13 October — numerous compromises of Danfoss AK-SM/AK-SC and Copeland xweb / Dixell xweb, confirmed refrigeration process impact in France, campaigns probably still running, factory-reset on EOL internet exposure insufficient. High confidence: Siemens 13 October is Crossbow V6.0, an S7-1500 web-server 9.6 with no firmware, Industrial Edge 9.1, and WinCC 8.8 — a Patch Tuesday pack, not a campaign. High confidence: ArmorBlock 12655 is an unauthenticated I/O web password with a 3.013 close, not a PLC write. High confidence: exposed controllers and engineering paths in AA26-097A / AA26-231A remain the incident class that has USG evidence. Moderate confidence: a non-trivial internet-facing refrigeration-manager estate exists outside France because contractor remote-maintenance is how grocery OT actually looks. Moderate confidence: Ivanti 104935, FortiBleed, GlobalProtect cookies, and CROSSBOW-on-the-jump-host are the IT-to-OT doors that will produce this week’s actual tickets. Low confidence: a new OT malware family dropped in the last seven days. Labeling a manufacturer ransomware victim, an Integrity Tech mailbox dump, an ArmorBlock password change, an Ignition Designer session, or an EseeCloud camera as “OT compromise” without process evidence remains a briefing error. The French fridge event is the exception this week because the process evidence is in the CSIRT text and in the operators’ own statements.

This assessment covers 9–16 October 2026 and was published 16 October 2026.