CISA Advisory ICSA-26-176-03: Horner Automation Cscape Out-of-bounds Read Vulnerability (CVE-2026-12897)

Vulnerability Overview Vulnerability Name: Horner Automation Cscape Release Date: June 25, 2026 Alert Code: ICSA-26-176-03 CVSS Score: v3.7.8 Vulnerability Type: Out-of-bounds Read Impact: Successful exploitation of this vulnerability may allow a local attacker to disclose information and execute arbitrary code. Scope of Impact Affected Versions: Cscape <10.2_SP3 Critical Infrastructure Sector: Critical Manufacturing Deployment Countries/Regions: Global Company Headquarters Location: United States Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems to ensure they cannot be accessed from the internet. - Place control system networks and remote devices behind firewalls and isolate them from the business network. - When remote access is required, use more secure remote methods, such as Virtual Private Networks (VPNs), and ensure that the VPN is updated to the latest version. - Organizations should conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures and report suspicious malicious activities. - Do not click on web links in unsolicited email messages or open attachments. - Refer to relevant resources to avoid email fraud and social engineering attacks. Additional Information Vulnerability ID: CVE-2026-12897 Reporter: Michael Heinzl Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Revision History Initial Release Date: June 25, 2026 Revision Version: 1 Summary: Initial Release Tags Sector: Critical Manufacturing Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Schneider Electric PowerLogic P7 Evoke Systems Charging Station Management System Daktronics Controller Firmware Yokogawa FAST/TOOLS and CI Server Contact Information CISA Central: 1-844-Say-CISA Contact Email: contact@cisa.dhs.gov Legal Notice and Terms of Use This product is subject to this notice and privacy and usage policy. Vendor Horner Automation Feedback Please share your thoughts. We have recently updated our anonymous product survey and welcome your feedback. Footer Links regarding CISA, Budget and Performance, DHS.gov, FOIA requests, No FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback, etc. Social Media Icons for Facebook, Twitter, LinkedIn, RSS, YouTube, Instagram, etc. Official Website CISA.gov, the official website of the U.S. Department of Homeland Security. Navigation Bar Links for Topics, Highlights, Resources and Tools, News and Events, Careers, About, etc. Search Box Provides search functionality. Share Buttons Provides sharing options for Facebook, Twitter, LinkedIn, Email, etc. Copyright The official website of the U.S. Department of Homeland Security. Other Information Links for Stay Safe, Free Cybersecurity Services, Designed for Safety, Protect Your Business, Report Cyber Incidents, etc. Summary This page details vulnerability information for Horner Automation Cscape, including the vulnerability overview, scope of impact, remediation, related advisories, contact information, legal notice, vendor, tags, revision history, feedback, footer, social media, official website, navigation bar, search box, share buttons, copyright, and other information.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory ICSA-26-176-03: Horner Automation Cscape Out-of-bounds Read Vulnerability (CVE-2026-12897)

More from this source