CISA Alert: MZ Automation libIEC61850 Multiple Vulnerabilities (Stack/Heap Overflow) CVE-2026-50039 etc.

Vulnerability Overview Vulnerability Name: MZ Automation libIEC61850 Release Date: July 23, 2026 Alert Code: ICSA-26-204-06 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: libIEC61850 >=v1.0.0 <=v1.6.1 CVSS Score: v3 8.1 Vendor: MZ Automation Device: MZ Automation libIEC61850 Vulnerability Types: - Stack Overflow - Heap Overflow - Improper Handling of Syntactically Invalid Structures - NULL Pointer Dereference Mitigation Strategies Recommended Practices: - Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods such as Virtual Private Networks (VPNs), and be aware that VPNs may have vulnerabilities; update to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying countermeasures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activities and adhere to CISA’s tracking and correlation procedures. - Do not click on web links in unsolicited emails or open attachments. - Refer to "Identifying and Avoiding Email Scams" for more information. - Refer to "Avoiding Social Engineering and Phishing Attacks" for more information. Vulnerability Details CVE-2026-50039 CVE-2026-49035 CVE-2026-50103 CVE-2026-50032 Background Critical Infrastructure Sector: Critical Manufacturing, Energy, Transportation Systems Deployment Regions: Global Company Headquarters Location: Germany Acknowledgments Reporter: Abhinav Agarwal reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is subject to this notice and the Privacy and Terms of Use Policy. Revision History Initial Release Date: July 23, 2026 Revision: 1 Summary: Initial Release Vendor MZ Automation GmbH Tags Sector: Critical Manufacturing Sector, Energy Sector, Transportation Systems Sector Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Recommendations Weintek cMT3092X Johnson Controls C-CURE 9000 and Victor application server Panduit IntraVUE MZ Automation lib60870 Feedback Please share your thoughts. We recently updated our anonymous product survey and welcome your feedback. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security About CISA: Budget and Performance, DHS.gov, FOIA Requests, Whistleblower Protection Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback --- Note: POC code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Alert: MZ Automation libIEC61850 Multiple Vulnerabilities (Stack/Heap Overflow) CVE-2026-50039 etc.