CISA Alert ICSA-26-197-04: AutomationDirect Productivity Suite Multiple Memory Corruption Vulnerabilities CVE-2026-60063 et al.

Vulnerability Overview Vulnerability Name: AutomationDirect Productivity Suite Publication Date: July 16, 2026 Alert Code: ICSA-26-197-04 Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: AutomationDirect Productivity Suite <=v4.6.2.2 CVE Identifiers: CVE-2026-60063, CVE-2026-61389, CVE-2026-60140, CVE-2026-57896, CVE-2026-60073, CVE-2026-61378 CVSS Score: v3.7 Vendor: AutomationDirect Device: AutomationDirect Productivity Suite Vulnerability Types: Out-of-bounds Write, Out-of-bounds Read, Division by Zero Remediation Recommended Practices: - Minimize the network exposure of all control system devices and systems, ensuring they are not accessible via the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods, such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities; therefore, they should be updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity for tracking and correlation analysis by CISA. - Do not click links in unsolicited emails or open attachments. - Refer to resources provided by CISA regarding avoiding email scams and social engineering attacks. Additional Information Background: - Critical Infrastructure Sector: Critical Manufacturing - Deployment Region(s): Global - Company Headquarters Location: United States Acknowledgements: - Luca Borzacchiello of Nozomi Networks reported these vulnerabilities to CISA. Revision History: - Initial Publication Date: 2026-07-16 - Revision: 1 - Summary: Initial Release Tags Industry: Critical Manufacturing Topic: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Advisories Rockwell Automation FactoryTalk DataMosaix Siemens SICAM 8 NASA Core Flight System (cFS) Health & Safety (HS) Application Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Legal Notices and Terms of Use This product is subject to these notices and the privacy and use policy. Vendor AutomationDirect Share Your Thoughts We have recently updated our anonymous product survey; your feedback is welcome. Related Advisories Rockwell Automation FactoryTalk DataMosaix Siemens SICAM 8 NASA Core Flight System (cFS) Health & Safety (HS) Application Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Back to Top Topics: Topics, Highlights, Resources and Tools, News and Events, Careers, About Cybersecurity and Infrastructure Security Agency CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov Official Website: Official website of the U.S. Department of Homeland Security About CISA Budget and Performance: Budget and Performance IG.gov: IG.gov FOIA Requests: FOIA Requests No FEAR Act: No FEAR Act Inspector General Office: Inspector General Office Ethics Policy: Ethics Policy Subscribe: Subscribe White House: White House USA.gov: USA.gov Website Feedback: Website Feedback Legal Notices and Terms of Use This product is subject to these notices and the privacy and use policy. Vendor AutomationDirect Tags Industry: Critical Manufacturing Topic: Industrial Control Systems Vulnerabilities, Industrial Control Systems Share Your Thoughts We have recently updated our anonymous product survey; your feedback is welcome. Related Advisories Rockwell Automation FactoryTalk DataMosaix Siemens SICAM 8 NASA Core Flight System (cFS) Health & Safety (HS) Application Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Back to Top Topics: Topics, Highlights, Resources and Tools, News and Events, Careers, About Cybersecurity and Infrastructure Security Agency CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov Official Website: Official website of the U.S. Department of Homeland Security About CISA Budget and Performance: Budget and Performance IG.gov: IG.gov FOIA Requests: FOIA Requests No FEAR Act: No FEAR Act Inspector General Office: Inspector General Office Ethics Policy: Ethics Policy Subscribe: Subscribe White House: White House USA.gov: USA.gov Website Feedback: Website Feedback Legal Notices and Terms of Use This product is subject to these notices and the privacy and use policy. Vendor AutomationDirect Tags Industry: Critical Manufacturing Topic: Industrial Control Systems Vulnerabilities, Industrial Control Systems Share Your Thoughts We have recently updated our anonymous product survey; your feedback is welcome. Related Advisories Rockwell Automation FactoryTalk DataMosaix Siemens SICAM 8 NASA Core Flight System (cFS) Health & Safety (HS) Application Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Back to Top Topics: Topics, Highlights, Resources and Tools, News and Events, Careers, About Cybersecurity and Infra

Goal Reached Thanks to every supporter — we hit 100%!

CISA Alert ICSA-26-197-04: AutomationDirect Productivity Suite Multiple Memory Corruption Vulnerabilities CVE-2026-60063 et al.