CISA’s Industrial Control Systems advisories provide the clearest consistent signal in OT security about which vulnerabilities are significant enough to warrant coordinated government disclosure. When five major industrial and building automation vendors appear in the same advisory cycle with high-severity CVEs, the message to organizations running these products is direct: prioritize assessment and patching.
May 2026’s ICS advisory release covers vulnerabilities in Schneider Electric, Advantech, Axis Communications, Rockwell Automation, and Mitsubishi Electric — a set of vendors whose products collectively appear in the majority of enterprise OT environments, smart buildings, and commercial facilities in North America and Europe. Here is what each advisory contains and what it means for organizations running the affected systems.
Schneider Electric EcoStruxure Foxboro DCS Advisor — CVSS 9.8
The highest severity advisory in this cycle addresses a deserialization of untrusted data vulnerability in Schneider Electric’s EcoStruxure Foxboro Distributed Control System Advisor component. The CVSS score of 9.8 reflects the severity of the underlying vulnerability class and the impact of exploitation.
Deserialization vulnerabilities in industrial control software follow a pattern that makes them particularly dangerous: the affected component processes data from an external source — in this case originating from a Windows Server Update Services (WSUS) vulnerability — and fails to validate that data before deserializing it. An attacker who can inject malicious serialized data into the affected data path achieves code execution on the DCS Advisor system.
Foxboro DCS is a distributed control system used in process industries — oil and gas, chemicals, power generation, water treatment, and pharmaceuticals. The DCS Advisor component provides advisory and optimization functions that interact with the core control system. A compromise of this component in an active production environment has direct implications for process operations.
Remediation: Schneider Electric has released patches for the affected component. Organizations running Foxboro DCS Advisor should assess their exposure and apply vendor patches according to the maintenance window constraints applicable to their production environment. In the interim, restricting network access to the WSUS interface and validating update source configuration reduces exposure.
Advantech WebAccess/SCADA — CVSS 8.8, Five CVEs
Advantech’s WebAccess/SCADA platform received five CVEs in this advisory cycle: CVE-2025-14850, CVE-2025-14849, CVE-2025-14848, CVE-2025-46268, and CVE-2025-67653, with a top CVSS score of 8.8. The vulnerability categories span path traversal, dangerous file upload, and additional web application security flaws.
WebAccess/SCADA is a browser-based SCADA platform widely used in building automation, energy management, and industrial monitoring. Its web interface architecture — which allows operators to access SCADA visualization and control functions through a browser — is also the attack surface for these vulnerabilities.
Path traversal vulnerabilities allow attackers to access files outside the intended directory structure, potentially exposing configuration files, credentials, and data that should not be accessible through the web interface. Dangerous file upload vulnerabilities allow attackers to upload executable content through the web interface, which can then be used to achieve code execution on the server.
The combination of these vulnerability types in a browser-accessible SCADA system is particularly significant in smart office and commercial building contexts, where WebAccess deployments may be accessible from corporate network segments or in some cases from the internet for remote monitoring.
Remediation: Advantech has released patches addressing all five CVEs. Organizations should also review network architecture to ensure WebAccess interfaces are not directly internet-accessible, and should restrict access to management interfaces to authorized user segments.
Axis Communications Camera Station Pro — CVSS 9.0, Three CVEs
Axis Communications, one of the leading manufacturers of IP security cameras and video surveillance systems, received advisories for CVE-2025-30023, CVE-2025-30025, and CVE-2025-30026 affecting Camera Station Pro, with a CVSS score of 9.0. The vulnerability categories include authentication bypass and code execution.
This advisory is directly relevant to smart office environments. IP security cameras from Axis are ubiquitous in commercial buildings, corporate campuses, and industrial facilities. Camera Station Pro is the video management software that controls recording, playback, and live monitoring across Axis camera deployments.
Authentication bypass vulnerabilities in video management software create a two-stage risk. First, an attacker who bypasses authentication gains access to live and recorded video — creating a physical security and privacy breach. Second, and more significantly for security architecture, video management systems are typically connected to both the corporate IT network and the physical security network, and a compromise of the VMS can serve as a pivot point between those two segments.
The CVSS 9.0 score for authentication bypass and code execution in Camera Station Pro means this is not a theoretical concern. Organizations running Axis Camera Station Pro in smart office or commercial building environments should treat this as a high-priority patching item.
Remediation: Axis has released updated firmware and software versions addressing the identified CVEs. Camera Station Pro software should be updated to the patched version. Additionally, organizations should review whether camera management interfaces are accessible from segments beyond the physical security network.
Rockwell Automation Micro820, Micro850, Micro870 — CVSS 7.5
Rockwell Automation’s Micro820, Micro850, and Micro870 controllers — compact PLCs used in small-scale automation, building control, and light industrial applications — received advisories for CVE-2025-13823 and CVE-2025-13824. The CVSS score of 7.5 covers a vulnerable third-party component and invalid pointer handling.
These controllers are common in smart building automation and building management systems, used for HVAC control, lighting automation, access control integration, and energy monitoring. Their prevalence in commercial building infrastructure means that a significant number of corporate offices and industrial facilities are running affected hardware.
The vulnerable third-party component category (CVE-2025-13823) reflects a supply chain security issue: a component embedded in the controller’s firmware from a third-party supplier contains a vulnerability. This is a category of risk that is increasingly important in OT security, where complex firmware supply chains make vulnerability tracking challenging.
Invalid pointer handling (CVE-2025-13824) is a memory safety issue that can lead to denial of service or potentially code execution depending on the specific implementation.
Remediation: Rockwell Automation has provided firmware updates for affected controller models. Organizations running Micro820/850/870 controllers should apply firmware updates during the next available maintenance window and validate controller operation after update.
Mitsubishi Electric ICONICS Suite — CVSS 8.2
Mitsubishi Electric’s ICONICS Suite, which includes GENESIS64, ICONICS Suite on-premise, MobileHMI, and MC Works64, received an advisory for CVE-2025-11774 with a CVSS score of 8.2 for OS command injection via a keypad function.
ICONICS is an HMI and SCADA software platform used across manufacturing, utilities, transportation, and building automation. GENESIS64, the flagship product, provides real-time data visualization, alarming, and control capabilities for complex industrial environments. MobileHMI extends those capabilities to mobile devices.
OS command injection via a UI component — the keypad function — is a serious vulnerability in industrial HMI software. An attacker who can interact with the affected keypad input mechanism can inject operating system commands that execute with the privileges of the HMI application. In industrial environments where HMI software runs with elevated privileges to control process equipment, OS command injection can provide a path from the HMI to underlying operating system functions and connected control systems.
The MobileHMI component extends the attack surface to mobile devices, which may be connected across less controlled network paths than fixed workstations.
Remediation: Mitsubishi Electric and ICONICS have provided updated software versions that address CVE-2025-11774. Organizations should update to patched versions and review access controls on HMI interfaces, particularly MobileHMI instances accessible from mobile devices or less-controlled network segments.
Reading ICS Advisories as a Security Program
One of the consistent challenges in OT security is that the advisory cadence from CISA — which publishes ICS advisories on a regular schedule — produces a volume of vulnerability information that is difficult to operationalize without a structured process.
Several practices help organizations extract actionable signal from CISA’s ICS advisory feed:
Maintain a current asset inventory by vendor and product. CISA advisories are organized by vendor and product; without an inventory that can be cross-referenced against advisory releases, organizations cannot quickly determine whether they run the affected software. The five vendors in this month’s advisories — Schneider, Advantech, Axis, Rockwell, Mitsubishi — are common enough that most medium-to-large enterprises with OT or smart building infrastructure will run at least one of them.
Establish CVSS thresholds for response urgency. A scoring threshold — for example, CVSS 9.0+ requires immediate assessment and patching plan within two weeks — converts advisory severity scores into operational timelines without requiring individual triage of every advisory. The Schneider Electric and Axis advisories in this cycle both clear that threshold.
Track OT maintenance windows. Patching in OT environments requires production downtime, which requires planned maintenance windows. An awareness of upcoming maintenance windows allows security teams to queue patches for deployment rather than discovering that a critical vulnerability requires an unplanned outage.
Include physical security systems in vulnerability management scope. The Axis Camera Station Pro advisory is a reminder that physical security infrastructure — cameras, access control, video management systems — carries network-connected vulnerabilities that require the same management attention as IT and OT systems.
The May 2026 ICS advisory cycle covers a broad cross-section of industrial and building automation infrastructure. Organizations that operate any of the five affected vendor platforms should use this advisory cycle as a trigger for assessment and remediation planning.
