In the September 2026 Patch Tuesday, Schneider Electric, Siemens, Aveva, and Rockwell Automation released multiple security advisories addressing critical and high-severity vulnerabilities in their industrial control system products. Schneider Electric patched four new advisories including a critical authentication flaw in Modicon M580 and M580 Safety controllers (CVE-2026-3869, CVSS 9.2). Siemens published nine new advisories covering critical vulnerabilities in Reyrolle 7SR5, Open Interface Services, Industrial Edge Management, and SIMOVE Fleetmanager, among others, and also rolled out fixes for the Copy Fail Linux kernel vulnerability (CVE-2026-31431, CVSS 7.8). Aveva addressed high-severity issues including a hardcoded encryption key and weak password hashing in Pipeline Integrity Monitor components. Rockwell Automation patched critical and high-severity flaws in RSLinx Classic and multiple controller modules. These coordinated patches address authentication bypass, privilege escalation, information disclosure, and unsafe deserialization vulnerabilities affecting ICS environments.

The vulnerabilities fixed in this Patch Tuesday cycle include critical authentication bypasses, privilege escalation, and information disclosure flaws in widely used ICS products. Exploitation could allow attackers to gain unauthorized access, execute code remotely, or obtain sensitive information within industrial control environments. The critical authentication vulnerability in Schneider Electric Modicon M580 controllers (CVE-2026-3869) has a high CVSS score (9.2), indicating a severe risk if exploited. Siemens' fixes include critical issues that could lead to unauthorized control or disruption of industrial processes. The Linux kernel Copy Fail vulnerability (CVE-2026-31431) patched by Siemens allows root shell access, posing a significant threat to affected systems. Aveva's flaws involving hardcoded keys and weak password hashing could compromise administrative credentials. Rockwell Automation's patches address critical flaws in key ICS communication and control software. Overall, these vulnerabilities pose serious risks to the confidentiality, integrity, and availability of industrial control systems if not remediated.

Patches have been released by Schneider Electric, Siemens, Aveva, and Rockwell Automation for the identified vulnerabilities. Organizations using affected ICS products should promptly apply the respective security updates as detailed in the vendors' advisories. Since these are critical and high-severity issues, timely patching is the primary recommended mitigation. No vendor advisory indicates that no action is required or that these issues are already mitigated without patching. Monitoring vendor advisories for updates and applying patches according to vendor guidance is essential to reduce risk.