Schneider Electric, Siemens, and Aveva patch critical flaws in industrial control systems
September 2026's industrial Patch Tuesday brings fixes for authentication failures, hardcoded encryption keys, and a Linux kernel flaw that lets attackers gain full system control.
Key points
- Schneider Electric's Modicon M580 controller carries a critical authentication flaw rated 9.2 out of 10 on the severity scale, tracked as CVE-2026-3869.
- Siemens patched a Linux kernel vulnerability, CVE-2026-31431, that allows an attacker to gain root access, meaning full administrative control, across several of its products.
- Aveva's Pipeline Integrity Monitor stored passwords using MD5, a hashing method so weak that attackers can often reverse it back into the original password.
- Rockwell Automation separately published nine advisories covering critical and high-severity bugs in products including RSLinx Classic and CompactLogix controllers.
- CISA has published advisories for more than twenty additional industrial products since August's patch round.
Every second Tuesday of the month, major industrial technology companies release security patches. September 2026 is a heavy one.
What did Schneider Electric fix?
The most urgent fix is a critical authentication flaw in the Modicon M580 and Modicon M580 Safety controllers, rated 9.2 out of 10. Authentication controls who can send commands to a system; a flaw here means an unauthorised person could take control without a valid password. We covered a separate Schneider session-management bug rated 8.3 on 3 September, so this is the second Schneider advisory we've reported in a fortnight.
Schneider published four new advisories and updated four older ones, including one originally issued in 2019, to note that patches are now available for the Modicon MC80 controller. The company also patched high-severity bugs in its PowerLogic T300 platform and EcoStruxure IT Data Center Expert product, and a medium-severity issue in SCADAPack x70 devices.
What did Siemens and Aveva fix?
Siemens published nine new advisories. Four cover critical-severity vulnerabilities across Reyrolle 7SR5, Open Interface Services, and SIMOVE Fleetmanager and SIPLANT products. High-severity fixes followed for Desigo CC, Teamcenter, the Mendix SAML module (a single sign-on component that handles user logins), and Element Maps.
Siemens also pushed updates to close CVE-2026-31431, a Linux kernel flaw disclosed in April. It allows an attacker who already has limited access to escalate to a root shell, meaning unrestricted control over the operating system. That's exactly the foothold scenario our 8 September story on securing Siemens PLCs warned operators to plan for.
| Vendor | Product | Flaw | Severity (CVSS) |
|---|---|---|---|
| Schneider Electric | Modicon M580 / M580 Safety | Authentication bypass, CVE-2026-3869 | 9.2 (Critical) |
| Siemens | Multiple products | Linux kernel root access, CVE-2026-31431 | 7.8 (High) |
| Siemens | Reyrolle 7SR5, OIS, others | Various critical flaws | Critical |
| Aveva | Pipeline Integrity Monitor | Hardcoded key, weak MD5 password hashing | High |
| Aveva | Enterprise SCADA | Unsafe deserialization (remote code execution risk) | Medium |
Aveva's problems centre on its PIMBoards component inside Pipeline Integrity Monitor. One flaw uses a hardcoded encryption key, baked into the software and identical across every installation, so anyone who finds it can decrypt sensitive data. A second issue involves passwords stored with MD5, an outdated algorithm that makes it relatively straightforward to work backwards to the original password. A third advisory, published before this Patch Tuesday, warns of an unsafe deserialization bug in Enterprise SCADA, where crafted input can execute malicious code remotely. Operators should treat the MD5 finding as the most immediately practical risk: administrative passwords that were hashed rather than encrypted are now effectively exposed.
What should organisations running this equipment do?
Apply the patches. Industrial control systems often run for years without updates, and that reluctance is what attackers count on. Check vendor portals directly and follow any temporary mitigations if a full patch can't be applied immediately.
CISA, the US government agency responsible for critical infrastructure security, has issued its own advisories covering more than twenty additional vendors since August's patch cycle, among them Johnson Controls, Furuno, and Hitachi Energy. Organisations outside the US should check with their national regulator.
First reported by SecurityWeek, the breadth of this month's advisories is a reminder that industrial equipment connected to a network carries real security obligations, not just operational ones.
