CISA warns on Eclipse Milo OPC UA flaws

CISA published advisory ICS-26-288-01 on vulnerabilities in Eclipse Foundation Eclipse Milo, an OPC UA stack used in industrial environments. According to the agency, exploitation could allow an attacker to delete protected data, recover credentials, impersonate legitimate users, or cause the server to stop responding. CISA identified energy, water and wastewater among the critical sectors involved.

What vulnerabilities did CISA identify?

CISA identified six CVEs in Eclipse Milo and recommended updating to Milo 1.1.5. The technical advisory lists CVE-2026-63252, CVE-2026-63248, CVE-2026-60007, CVE-2026-62927, CVE-2026-58080 and CVE-2026-61387. The agency’s recommendation points to the fixed 1.1.5 branch as the update target.

What is known about CVE-2026-60007?

CVE-2026-60007 can be exploited through an observable discrepancy in the processing of UsernameToken tokens under Basic128Rsa15. According to Security Boulevard, an attacker on the network would need to capture an encrypted token and send repeated ActivateSession requests. The published result for the flaw assigns it a CVSS v4.0 score of 9.1, classified as critical.

Why does the case matter for OT and ICS?

Milo is a library that can be embedded in SCADA products, gateways and control systems, so identifying affected products requires finding implementations that include the dependency. Trout Software said that makes the review harder because the component may appear inside other solutions rather than as a visible product on its own.

What happens for those using the 0.6.x branch?

Versions in the 0.6.x branch do not have a fixed release of their own. According to Adyog Pulse, users still on that line must migrate to Milo 1.1.5 or later instead of waiting for a specific 0.6.x patch. That leaves those users with a single remediation path based on version upgrading.