CISA ICSA-26-211-11 MZ Automation lib60870 Out-of-Bounds Read Vulnerability Advisory

Vulnerability Overview Vulnerability Name: MZ Automation lib60870 Publication Date: July 30, 2026 Alert Code: ICSA-26-211-11 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: lib60870 2.4.0 (CVE-2026-61893, CVE-2026-63033) CVSS Score: v3 6.5 Vendor: MZ Automation GmbH Device: MZ Automation lib60870 Vulnerability Type: Out-of-bounds Read Critical Infrastructure Sector: Energy, Water and Wastewater Systems, Critical Manufacturing, Chemical Sector Deployment Country/Region: Global Company Headquarters Location: Germany Mitigation Recommended Practices: - Minimize network exposure, ensuring that all control system equipment and/or systems are not accessible via the internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure communication methods, such as Virtual Private Networks (VPNs). - Ensure that VPNs are updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying defenses. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and report findings to CISA for tracking and correlation analysis. Vulnerability Details CVE-2026-61893: Out-of-bounds Read CVE-2026-63033: Out-of-bounds Read Revision History Initial Publication Date: July 30, 2026 Revision: 1 Summary: Initial Release Additional Information Acknowledgements: Arun Babu Puthuparambil of the Central Power Research Institute, Bengaluru, India, reported these vulnerabilities to CISA. Legal Notice and Terms of Use: This product is subject to this notice and privacy and usage policy. Tags Industry: Chemical Sector, Critical Manufacturing Sector, Energy Sector, Water and Wastewater Systems Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Schneider Electric IGSS: ICSA-26-211-04 Johnson Controls OpenBlue Employee: ICSA-26-211-02 MikroTik RouterOS: ICSA-26-211-01 Toptech Systems RCU II+ and Multiload II+: ICSA-26-211-03 Feedback Share your thoughts; we recently updated our anonymous product survey and welcome your feedback. Contact Information CISA Hotline: 1-844-Say-CISA, contact@cisa.dhs.gov Official Information CISA.gov: Official website of the U.S. Department of Homeland Security Additional Links About CISA: Budget and Performance, OIG.gov, FOIA Requests No FEAR Act: Office of Inspector General, Privacy Policy, Subscribe White House: USA.gov, Website Feedback --- The above is a summary of key information regarding vulnerabilities from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-211-11 MZ Automation lib60870 Out-of-Bounds Read Vulnerability Advisory