On October 15 2026, CISA released ICS Advisory ICSA‑26‑288‑01 regarding several vulnerabilities found in the Eclipse Foundation’s Eclipse Milo.
Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.
One vulnerability, CVE‑2026‑62927, allows an anonymous or low‑privileged client to execute a denied method by batching it with an allowed method in the Call service; this issue has a CVSS v3.1 base score of 7.5 and a CVSS v4.0 base score of 8.7 and is mapped to CWE‑863 (Incorrect Authorization). CVE‑2026‑63252 allows a remote unauthenticated client to potentially terminate the server by exhausting pooled direct memory through repeated sending of incomplete chunks and disconnecting; this vulnerability is mapped to CWE‑401 (Missing Release of Memory after Effective Lifetime). In CVE‑2026‑58080, the OpcUaServerConfig.copy() function fails to preserve a configured RoleMapper, which can allow an anonymous client where anonymous sessions are permitted to read role‑permission metadata, invoke protected methods, or delete protected nodes. Additionally, CVE‑2026‑63248 involves OPC UA server diagnostics nodes that do not enforce access authorization.
The affected versions of Eclipse Milo include 0.6.0 through 1.1.4 for CVE‑2026‑63252, CVE‑2026‑63248, and CVE‑2026‑60007, while versions 1.0.0 through 1.1.4 are also affected by CVE‑2026‑62927, CVE‑2026‑58080, and CVE‑2026‑61387. The Eclipse Foundation recommends that users upgrade to Eclipse Milo 1.1.5 to remediate the vulnerabilities. For users on the 0.6.x branch, no fixes are available for those versions, requiring migration to version 1.1.5 or later.
The identified critical infrastructure sectors include Chemical, Critical Manufacturing, Energy, and Water and Wastewater. The Eclipse Foundation, headquartered in Belgium, issued the advisory.
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01