ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Rockwell, Schneider
Source SecurityWeek
Rated by Threat Radar
Data as of 15 Jul 2026, 09:32 UTC
What to do
AI-suggested
Official patches have been released by Siemens, Rockwell Automation, Schneider Electric, and Phoenix Contact to address these vulnerabilities. Organizations using affected products should apply the vendor-provided updates promptly to mitigate the risks. Since these are on-premises ICS/OT products, remediation requires manual patch deployment following vendor guidance. Patch status is confirmed as fixed by the vendors.
Description
Multiple industrial control system (ICS) vulnerabilities have been patched by Siemens, Rockwell Automation, Schneider Electric, and Phoenix Contact. These vulnerabilities affect a variety of ICS/OT products and include issues that could lead to arbitrary code execution, denial of service, unauthorized access, man-in-the-middle attacks, and information disclosure. Siemens addressed critical vulnerabilities in Comos, Sicam T, and Ruggedcom ROX products, as well as high and medium severity issues in other products. Schneider Electric patched vulnerabilities related to Windows Server Update Services and ZombieLoad affecting EcoStruxure Foxboro DCS. Rockwell Automation fixed a high-severity denial of service and SQL injection vulnerabilities. Phoenix Contact addressed multiple vulnerabilities including XSS and authentication issues in its FL SWITCH 2xxx series. These vulnerabilities have been officially patched by the vendors.