Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems

In late August 2026, two private water utilities in Colorado were targeted by cyberattacks aimed at their operational technology (OT) systems. Attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The disruptions were brief and did not affect water services or public safety. The attackers are described as foreign actors, with possible links to an Iranian-backed group known to target water and wastewater systems in the U.S. The incident is part of a broader pattern of cyberattacks against water sector infrastructure across multiple states. No specific technical details or affected versions are available.

• securityweek.com/colorado-water-utilities-hit-by-cyberattacks-targeting-ot-systems/ (opens in a new tab)

• ZDI-26-870: (0Day) Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability2026-11-04
• ZDI-26-871: (0Day) Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability2026-11-04
• ZDI-26-872: (0Day) Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution VulnerabilityHighVulnerability2026-11-04
• ZDI-26-873: (0Day) Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability2026-11-04
• ZDI-26-874: (0Day) Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution VulnerabilityHighVulnerability2026-11-04