CISA scored ICONICS 9.1. MC Works64 has no fix. The exploited box this week is a VeloCloud, not a historian.

23–30 October 2026. CISA 27 Oct — ICSA-26-300-02 ICONICS/GENESIS header 9.1 (CVE-2026-16438 DCOM); the unlock challenge is one fixed response for every user (CVE-2026-16436). 10.98 / 11.04 close most trains; MC Works64, GENESIS32 and BizViz have no patch. Same day: EPICS Base 9.8 unauth integer overflow, 7.0.11. 29 Oct: Hitachi TRO600 9.2.2.1, CoreTec5 5.0.0, Mendix SAML 4.2.4. KEV this window is Arista VCO 23 Oct and Cisco ASA SSL-VPN DoS 29 Oct, not a PLC.

RWP Ventures · 2026-10-30 · 19 min read · priority 8.6

The finding that belongs at the top of a manufacturing SCADA queue is not last week’s Software Center ClickFix. On 27 October CISA republished Mitsubishi Electric 2026-006 as ICSA-26-300-02 (CSAF tracking: vendor 15 October, CISA conversion 27 October, product-name pass 29 October). Header CVSS 3.1 9.1 is CVE-2026-16438 — Incorrect Privilege Assignment. The ICONICS installer grants the product administrator default DCOM permissions that work locally or from the network. That is not unauthenticated remote code execution. Privileges required are high. Scope is changed.

Do not collapse four facts. CVE-2026-16436 is the one operators will actually hunt: Weak Password Recovery, 8.1 (AV:N/AC:H/PR:N). The challenge response used to unlock the system is common to all users and fixed. A remote attacker who obtains that response can unlock. CVE-2026-16437 is the local-admin twin (6.4) against the same challenge file. CVE-2023-4863 is libwebp, local, 8.2, already closed in 10.97.3. Floors for 16436/16437/16438: GENESIS 11.04, GENESIS64 / ICONICS Suite / Hyper Historian / AnalytiX / MobileHMI / IoTWorX 10.98. MC Works64, GENESIS32 and BizViz: no fix planned. Replace or isolate. SSVC on the CSAF is E:N — no known exploitation.

The other original 27 October ICSA is ICSA-26-300-01 EPICS Base ≤ 7.0.10. CVE-2026-114595 is an integer overflow in network request processing, 9.8 unauthenticated (AV:N/AC:L/PR:N), memory corruption / DoS / potential RCE. Three more protocol-parse rows (114596 8.2, 114597 7.5, 114598 7.5). Close 7.0.11. Shubham Raj, Cipher / Causal Security. CISA sector Critical Manufacturing. EPICS is the control system for accelerators and large science facilities; do not brief it as a packaging-line PLC.

On 29 October CISA converted two Hitachi Energy PSIRTs and one Siemens ProductCERT. ICSA-26-302-02 TRO600 (8DBD000224): CVE-2026-106087 unauthenticated arbitrary file read including configuration and password data, 7.5 v3.1 / 8.7 v4.0; CVE-2026-10756 authenticated port-forward past localhost bindings, 7.5. Floor 9.2.2.1 (9.1 branch 9.1.2.0). Hitachi’s summary sentence says RCE; the CVE text does not. Stick to the CVE text. ICSA-26-302-03 CoreTec (8DBD000258): CVE-2026-13162 authenticated OS command injection in the timezone handler, 7.5; CVE-2026-43284 local Dirty Frag-class write-what-where in in-kernel IPsec ESP, 8.8. Affected as converted: CoreTec5 ≤ 3.4.0 and CoreTec4 ≤ 3.4.0. Vendor close CoreTec5 5.0.0 (CoreTec4 upgrades to 5.0.0). Hitachi names Dirty Frag in that advisory. That is not a confirmed identity with kernel [CVE-2026-46300](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/) (Fragnesia, KEV 28 October). Related class. Different ticket.

ICSA-26-302-01 is Siemens SSA-137528 Mendix SAML — CVE-2026-89209, SAML assertion replay on IdP-initiated flows, 6.8. Floors V4.2.4 (Mendix 10/11) / V3.6.29 (Mendix 9). Workaround: disable IdP-initiated SSO. Cloud identity module, not a PLC.

CERT-FR’s CERTFR-2026-ALE-012 last-version stamp is still 16 October. No product-class expansion this window. Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb remain.

The CONFIRMED in-the-wild tickets with a 23–30 October KEV timestamp that OT operators should treat as live IT-to-OT doors are not historians except the leftover Software Center row. Catalog freeze this morning: 2026.10.29 / 1764, dateReleased 2026-10-29T19:09:34.4003Z. 23 October added Arista VeloCloud Orchestrator CVE-2026-114625 (due 26 October, now past). Last week’s weekly said it was exploited and not on KEV; the increment is the row. 29 October added Cisco ASA/FTD CVE-2026-76418 (SSL VPN reload, 8.6, due 1 November) and GitLab CVE-2026-97229. None of those are ICS malware. Software Center CVE-2026-110936 is still due 3 November.

Do not upgrade ICONICS, EPICS, or TRO600 into FrostyGoop. Last week’s standing hunt is unchanged except the SCADA-host DCOM/unlock pair: internet-reachable PLCs and engineering-client abuse named in AA26-097A and AA26-231A. CVE-2026-3869 on M580 / M580 Safety still has no CISA ICSA as of 30 October morning. Hitachi FACTS FCP/GWS still has no versioned patch in the 17 September ICSA.

OT threat posture

A manufacturing SCADA/HMI/historian stack with a fixed unlock challenge and a network-usable DCOM grant is this window’s original OT work. CISA and Mitsubishi still tag it no known public exploitation. That is a lower-confidence incident class than last week’s Software Center ClickFix, and a higher-confidence exposure class than EPICS 9.8, which is real protocol memory corruption on a niche control system. It is not a higher-confidence process incident than the French refrigeration event. Exposure, engineering-path abuse, and a KEV’d plant VPN remain the standing hunt. Ransomware still hurts plants by killing the Windows, mail, and hypervisors OT depends on. Cisco ASA 76418 is an availability hit on the SSL VPN, not a process write. No public primary source this week documented a new ladder-logic change or a new ICS-specific wiper.

1. Most significant development

CISA’s 27 October conversion of Mitsubishi Electric 2026-006 as ICSA-26-300-02, because it is a widely deployed SCADA/HMI/historian family, the header is 9.1, the unlock challenge is one fixed response for every user, and three shipping products have no patch.

Why this outranked the rest of the week: EPICS 114595 is the higher CVSS — 9.8 unauthenticated on a network protocol — and it would have been the lead in a week without a manufacturing SCADA conversion that also leaves MC Works64, GENESIS32 and BizViz unpatched. It is still a science-facility control system, not a packaging line. TRO600 106087 is a real unauthenticated file-read on an energy communications box, versioned 9.2.2.1 the same CISA day, and it would have been ~7.8. CoreTec 43284 is a local kernel row Hitachi itself labels Dirty Frag; it is not Fragnesia’s KEV identity. Mendix 89209 is 6.8 SAML replay. Arista 114625 going on KEV 23 October is the exploited IT-to-OT increment (already [23 October Daily Top](/posts/2026-10-23-arista-velocloud-cve-2026-114625/)); Cisco 76418 is a VPN reload, not RCE. Score for the week: 8.6. EPICS-as-lead would have been ~8.1. TRO600-as-lead ~7.8. Arista-KEV-as-lead ~7.9 as a path, not as ICS. No ICONICS, EPICS, TRO600, CoreTec, or Mendix CVE is on KEV this morning.

2. Adversary / campaign activity

CONFIRMED (continuing, engineering workstation, not process): Siemens Software Center CVE-2026-110936. ProductCERT 19 October, KEV 20 October, due 3 November, ICSA-26-295-03 22 October. [20 October Daily Top](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/). No new ProductCERT census, implant family, or second signed binary this window. Process impact: none claimed.

CONFIRMED (continuing, OT process, not this week’s increment): CERTFR-2026-ALE-012. Last version still 16 October. Product class unchanged: Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb. Named actor: none. CVE: none. Extra-France victims of the 11–12 October night: UNKNOWN until another CSIRT publishes.

CONFIRMED (this window, not ICS malware): Arista VCO CVE-2026-114625 on KEV 23 October. Vendor-confirmed exploited SQLi; federal due 26 October. Cisco ASA/FTD CVE-2026-76418 on KEV 29 October — unauthenticated SSL VPN reload when secondary authentication is on the tunnel group. Cisco PSIRT learned of exploitation in October; no actor, no victim census. Availability of the VPN, not a process write. GitLab 97229 is a DevOps RCE; [30 October Daily Top](/posts/2026-10-30-gitlab-cve-2026-97229-kev/). Fragnesia kernel 46300 is [29 October Daily Top](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/). SafePay AA26-293A remains last week’s edge-ransomware advisory. Integrity Tech AA26-281A remains the 8 October USG story. ConnectWise / SkyKick is still an IT compromise of Microsoft 365 until logs show a process write. We do not have it.

Continuing, still the current hunt set:

• AA26-097A (April, updated 22 July): Iran-affiliated actors using Studio 5000 / EcoStruxure Control Expert / TIA Portal against internet PLCs. CONFIRMED as USG. No new victim set this window.
• FBI/EPA 30 July water PSA: MicroLogix 1100/1400, seven states. CONFIRMED as PSA. Not this week’s news.
• AA26-231A (19 August): recon and capability development on US S7-200/300/400/1200. CONFIRMED as USG wording. Now ten weeks old. No new victim set this window.

UNKNOWN a 23–30 October named victim with a confirmed ladder-logic, ICONICS-tag, EPICS-PV, TRO600-config, or CoreTec timezone-handler change.

3. Vulnerabilities and active exploitation

CONFIRMED (CISA ICS, 27 October) — original work this window.

CONFIRMED (CISA ICS, 29 October) — Hitachi and Siemens conversions.

CONFIRMED (active exploitation, mixed OT-adjacent / not ICS): KEV freeze 2026.10.29 / 1764. Arista 114625 added 23 October, due 26 October. Cisco ASA/FTD 76418 added 29 October, due 1 November, ransomware Unknown, forensic triage No. GitLab 97229 same add, due 1 November. PHP2Shell 109618 / 109619 due 29 October (yesterday). Fragnesia 46300 due 31 October (tomorrow). Software Center 110936 still due 3 November. Plex / SiteGuard / Collabora / Brotli / Adobe Commerce are IT. No ICONICS, EPICS, TRO600, CoreTec, Mendix, WAGO, or S7-web CVE is on that catalog this morning.

Still missing from CISA ICS: Schneider CVE-2026-3869 on M580 / M580 Safety. Seven-week watch item. Primary remains SEVD-2026-251-04. Hitachi FACTS ICSA-26-260-03 still names no patched FCP version.

4. ICS / SCADA impact

CONFIRMED process impact this window: none new. Last week’s French grocery refrigeration remains the last well-sourced availability hit. CERT-FR’s stamp did not move.

No CONFIRMED new loss-of-view or loss-of-control event dated 23–30 October in Mitsubishi 2026-006, EPICS 7.0.11 notes, Hitachi 8DBD000224/000258, or Siemens SSA-137528.

What would become process impact, if exploited on an exposed or poorly segmented box:

• ICONICS 16436 → unlock of the SCADA/HMI/historian host by anyone who has the fixed challenge response. 16438 → DCOM operations as the product administrator from a host that can reach that DCOM. That is a SCADA-host finding. It is not a confirmed PLC write. Hunt the challenge file and the DCOM ACL before you call it a process event.
• EPICS 114595 → memory corruption in the IOC that serves PVs. Science facilities, some manufacturing test stands. Close 7.0.11. Do not brief it as a Siemens or Rockwell PLC.
• TRO600 106087 → credential and config file off an energy communications node without a login. 10756 → authenticated reach into localhost services. Hitachi’s RCE sentence is not a third CVE.
• CoreTec 13162 → root-equivalent commands from an authenticated timezone write. 43284 → local user to root via ESP. Transformer monitoring, not a breaker trip unless the operator’s own process evidence says so. Nobody has published that.
• Mendix 89209 → replay of a valid SAML assertion into a cloud app. Identity. Not a controller.
• Arista VCO 114625 / Cisco ASA 76418 / leftover Software Center / SafePay against a utility or plant tenant → IT compromise at an industrial company, or VPN availability. ASSESSED IT-to-OT path. Not a process event in those advisories.

Prior water PLC tampering (July) and the UK small-generator outage (late July, disclosed August) remain the last well-sourced availability hits before the fridge week. They are not this week’s news.

5. IT-to-OT exposure

Seven doors this week, in the order operators can actually hunt:

1. ICONICS / GENESIS / Hyper Historian hosts, including MC Works64. 10.98 / 11.04 on trains that have a patch. MC Works64, GENESIS32, BizViz: take the server off every VLAN that is not a named engineering host, or replace. Blank-and-ACL the challenge .dat if you cannot patch this window.
2. On-prem VeloCloud Orchestrator. CVE-2026-114625 is on KEV as of 23 October, due 26 October. Floors still 5.2.3.18 / 6.1.3.10 / 6.4.2.12. September’s 5.2.3.16 / 6.4.2.8 do not close it. [23 October Daily Top](/posts/2026-10-23-arista-velocloud-cve-2026-114625/).
3. Cisco ASA / FTD that is the plant, contractor, or jump-host SSL VPN, with secondary authentication on the tunnel group. CVE-2026-76418, exploited, KEV due 1 November. Reload is a DoS, not a shell. No workaround that keeps secondary auth. First fixed: ASA 9.16.4.104 / 9.18.4.96 / 9.20.4.50 / 9.22.3.200 / 9.23.1.48 / 9.24.1.27 (or 9.24.10.1); FTD 7.0.11 / 7.2.13 / 7.4.9 / 7.6.7 / 7.7.14 / 10.0.3 / 10.1.1.
4. Siemens Software Center on any engineering PC. 4.0.9.8 on the real install; hunt AppData / msiexec. KEV due 3 November.
5. Internet-facing refrigeration system managers — Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb. CERT-FR 16 October did not retire the 13 October order.
6. TRO600 / CoreTec on the substation or transformer yard. 9.2.2.1 / CoreTec5 5.0.0. Unauthenticated file-read is the TRO600 reachability problem; WBM-class management on CoreTec is the 13162 problem.
7. Ivanti Connect Secure / BeyondTrust Remote Support / leftover WAGO WBM / CROSSBOW V6.0 from the last two weeklies. Those due dates have passed. Rebuild and firmware conditions still apply.

Ignition, engineering workstations, and internet-facing 44818/102/502/2222 remain the standing hunt from AA26-097A / AA26-231A. That hunt does not reset because CISA converted a historian advisory.

6. Sector impact

• Process manufacturing / discrete on ICONICS or Mitsubishi MC Works64: inventory 10.97.3 vs 10.98, GENESIS vs 11.04. MC Works64 / GENESIS32 / BizViz have no vendor floor — isolate or migrate. DCOM from the IT VLAN is the 16438 precondition. Software Center hunt still applies if the same site runs TIA.
• Science / accelerator / large R&D: EPICS Base 7.0.11. 114595 is unauthenticated on the CA/PVA path. Do not wait for a CISA KEV row.
• Electric / transmission: TRO600 9.2.2.1. CoreTec5 5.0.0. Last week’s CROSSBOW / SAC V6.0, RTU500 supported train 12.7.8 / 13.9.1, SYS600 10.8, S7-1500 web server off the WAN, APE1808 as the PAN-OS/FortiGate train. FACTS FCP/GWS still has no versioned firmware. AA26-231A S7 exposure is still the Siemens PLC lead. ASA 76418 if that is the utility SSL VPN.
• Oil and gas / chemical midstream: ICONICS if that is the terminal or pipeline HMI. Last week’s Sage RTU C3414-500-S02L0 and TMS7 / TopHAT 7.8 are still open. Moxa AIG-302 1.4.1 if that gateway is on a tank or well pad.
• Food / grocery / cold-store 3PL: CERT-FR class is not closed. 16 October did not add a CVE. Independent probe temperature. ICONICS if the site also runs Mitsubishi visualization on the packaging line.
• Building / commercial facilities: last week’s Pro-face STW6000 (no patch) and APOGEE/Desigo SSA-333035. Mendix only if that app is the tenant portal, not the BAS.
• Water / small SCADA: last week’s WAGO 4.10.0, Moxa AIG-302, Milo 1.1.5. VeloCloud and ASA against a utility VPN are IT tickets until logs show a process write.
• Anyone with a plant SSL VPN on ASA/FTD: 76418 is a reload. Secondary authentication on the tunnel group is the precondition. Patch; do not “mitigate” by turning MFA off.

7. Defensive priorities

1. ICONICS / GENESIS / Hyper Historian to 10.98 / GENESIS 11.04. MC Works64, GENESIS32, BizViz: isolate or replace. Blank-and-ACL the challenge .dat if the window is later.
2. Internet-facing PLC eradication — still number two. VPN or jump host, never the controller. AA26-097A / AA26-231A have not been withdrawn.
3. On-prem VeloCloud Orchestrator to 5.2.3.18 / 6.1.3.10 / 6.4.2.12. KEV due date is already past.
4. Cisco ASA/FTD SSL VPN with secondary auth — 76418 due 1 November. First fixed builds above. Do not drop secondary auth as the close.
5. Siemens Software Center hunt, then 4.0.9.8. KEV due 3 November.
6. Refrigeration UIs off the internet — CERT-FR order, not a CVE wait. Danfoss, Copeland xweb, Dixell xweb.
7. Hitachi TRO600 9.2.2.1. CoreTec5 5.0.0. EPICS Base 7.0.11 where that stack runs.
8. Mendix SAML 4.2.4 / 3.6.29, or IdP-initiated SSO off.
9. Open from prior weeks: WAGO 4.10.0, CROSSBOW V6.0, SYS600 10.8, RTU500 12.7.8 / 13.9.1 (11.x still migrate), ArmorBlock 3.013, Ignition 8.1.55 / 8.3.9, Sage RTU C3414-500-S02L0, Pro-face isolate, Milo 1.1.5, N-Tron 3.11.1, TMS7 7.8, Armatura One 4.7.2, MikroTik 7.24 (CVE-2026-84411, still not KEV), FACTS GWS (no versioned patch), M580 SEVD-2026-251-04 (still no ICSA), Ivanti 104935 rebuild, BeyondTrust 102764, S7-1500 web until SSA-591731.
10. Do not wait for ICS-specific malware. Last week’s process loss did not need a named wiper. This week’s SCADA conversion does not need one either.

8. What changed from last week

[Last week (ending 23 October)](/posts/2026-10-23-weekly-ot-siemens-ssc-wago-hitachi/) was Siemens confirming Software Center is being used as a signed ClickFix loader (19 Oct), CISA putting that CVE on KEV (20 Oct, due 3 Nov) and converting it to ICSA-26-295-03 (22 Oct), plus CISA’s 20 October original pack — WAGO 8.8, Moxa 8.1, HMS PCAN, SYS600 7.8 — and CISA converting Hitachi’s supported-train RTU500 advisory and last Tuesday’s Siemens pile. Arista VCO 114625 was exploited and not on KEV.

This week the original OT work is CISA converting Mitsubishi 2026-006 (ICONICS/GENESIS 9.1, unlock challenge shared, three products with no patch) and EPICS Base 9.8, then 29 October Hitachi TRO600 / CoreTec and Mendix SAML. CERT-FR 16 October did not move. No new USG PLC campaign update. No new FBI/EPA water PSA. CVE-2026-3869 on M580 still has no ICSA. FACTS GWS still has no versioned patch. The exploited activity moved from Software Center 110936 (still due 3 November) plus Arista not on KEV, to Arista on KEV (23 October, due 26 October) and Cisco ASA 76418 (29 October, due 1 November). AA26-231A is ten weeks old.

9. What OT defenders should watch next

Whether Mitsubishi or ICONICS publishes exploitation, or CISA puts 16436/16438 on KEV. Whether MC Works64 customers actually migrate. Whether EPICS 114595 is observed on an IOC that was left on a campus VLAN. Whether Hitachi’s TRO600 “RCE” sentence gets a third CVE or stays file-read. Whether CoreTec 43284 is formally mapped to kernel CVE-2026-46300. Whether ProductCERT adds a Software Center victim census before the 3 November due date. Whether CERT-FR revises ALE-012 with a CVE or a non-French CSIRT joint. Whether CISA finally republishes CVE-2026-3869. Whether Hitachi publishes a versioned FCP/GWS patch. Whether ASA 76418 stays a reload or picks up a second bug. Q3 industrial ransomware counts. Any AA26-097A or water-PSA refresh.

10. RWP assessment

High confidence: this week’s OT lead is ICSA-26-300-02 as CISA’s 27 October conversion of Mitsubishi 2026-006 — a manufacturing SCADA/HMI/historian family with a 9.1 DCOM grant, a fixed unlock challenge, and three products with no patch — not a PLC write and not confirmed process impact. High confidence: EPICS CVE-2026-114595 is unauthenticated network memory corruption on Base ≤ 7.0.10, versioned at 7.0.11, with no public exploitation as of this retrieval. High confidence: TRO600 CVE-2026-106087 is unauthenticated file-read, not a demonstrated RCE, versioned at 9.2.2.1. High confidence: no ICONICS, EPICS, TRO600, CoreTec, or Mendix CVE is on KEV catalog 2026.10.29 / 1764. High confidence: Arista 114625 on KEV (23 October) and Cisco 76418 on KEV (29 October) are the in-the-wild tickets this window; both are IT-to-OT paths, not ICS malware. Moderate confidence: a non-trivial ICONICS estate is still on 10.97.x or MC Works64 because those trains are how the product was sold. Moderate confidence: leftover Software Center 110936 (due 3 November) plus ASA 76418 (due 1 November) are the tickets that will produce this week’s actual plant-adjacent pages. Low confidence: a new OT malware family dropped in the last seven days. Labeling a manufacturer ransomware victim, an ICONICS DCOM grant, an EPICS IOC crash, a TRO600 file-read, or an ASA VPN reload as “OT compromise” without process evidence remains a briefing error. Last week’s French fridge event remains the last process exception because the process evidence is in the CSIRT text.

This assessment covers 23–30 October 2026 and was published 30 October 2026.