CISA Advisory ICSA-26-197-07: SALTO ProAccess Space Auth Bypass via User-Controlled Key

Vulnerability Overview Vulnerability Name: SALTO ProAccess Space Release Date: July 16, 2026 Alert Code: ICSA-26-197-07 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: SALTO ProAccess Space <6.13 (CVE-2026-11889) CVSS Score: v3.6.5 Vendor: SALTO Device: SALTO ProAccess Space Vulnerability Type: Authorization bypass via user-controlled key Critical Infrastructure Sector: Commercial Facilities, Critical Manufacturing Deployment Countries/Regions: Global Company Headquarters Location: Spain Remediation Recommended Practices: - Minimize network exposure, ensuring that all control system devices and/or systems are not directly accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods such as Virtual Private Networks (VPNs), and ensure the VPN is updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying countermeasures. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activities for CISA tracking and correlation analysis. Additional Information Background: - Successful exploitation of this vulnerability allows an authenticated attacker to elevate privileges and access spaces outside of the same SALTO ProAccess Space installation or system's partition. - Exploitation requires valid operator credentials and the partition feature to be enabled; installations without partitioning enabled are not affected. Acknowledgments: - Bernhard Lorenz of Limes Security reported this vulnerability to CISA. Legal Notice and Terms of Use: - This product is subject to this notice and the Privacy and Use Policy. Revision History: - Initial Release Date: 2026-07-16 - Revision: 1 - Summary: Initial Release Tags Sector: Commercial Facilities Sector, Critical Manufacturing Sector Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Rockwell Automation FactoryTalk DataMosaix AutomationDirect Productivity Suite NASA Core Flight System (cFS) Health & Safety (HS) Application Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Feedback Please share your thoughts: We recently updated our anonymous product survey, and feedback is welcome. Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Official Information CISA.gov Official website of the U.S. Department of Homeland Security Links About CISA Budget and Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback Social Media Facebook X LinkedIn YouTube Instagram RSS Search Search Box Navigation Bar Topics Spotlight Resources & Tools News & Events Careers About Share Facebook X LinkedIn Email Alert Code ICSA-26-197-07 Related Topics Industrial Control System Vulnerabilities Industrial Control Systems Vulnerability Details CVE ID: CVE-2026-11889 CVSS Score: v3.6.5 Vendor: SALTO Device: SALTO ProAccess Space Vulnerability Type: Authorization bypass via user-controlled key Recommended Practices Minimize network exposure Use firewall isolation Use secure remote access methods Conduct impact analysis and risk assessment Implement cybersecurity policies Report suspicious activities Acknowledgments Bernhard Lorenz of Limes Security Legal Notice This product is subject to this notice and the Privacy and Use Policy Revision History Initial Release Date: 2026-07-16 Revision: 1 Summary: Initial Release Tags Sector: Commercial Facilities Sector, Critical Manufacturing Sector Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Rockwell Automation FactoryTalk DataMosaix AutomationDirect Productivity Suite NASA Core Flight System (cFS) Health & Safety (HS) Application Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Feedback Please share your thoughts: We recently updated our anonymous product survey, and feedback is welcome. Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Official Information CISA.gov Official website of the U.S. Department of Homeland Security Links About CISA Budget and Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback Social Media Facebook X LinkedIn YouTube Instagram RSS Search Search Box Navigation Bar Topics Spotlight Resources & Tools News & Events Careers About Share Facebook X LinkedIn Email Alert Code ICSA-26-197-07 Related Topics Industrial Control System Vulnerabilities Industrial Control Systems Vulnerability Details CVE ID: CVE-2026-11889 CVSS Score: v3.6.5 Vendor: SALTO Device: SALTO ProAccess Space Vulnerability Type: Authorization bypass via user-controlled key Recommended Practices Minimize network exposure Use firewall isolation Use secure remo

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory ICSA-26-197-07: SALTO ProAccess Space Auth Bypass via User-Controlled Key