Welcome to the first edition under our narrowed focus: critical infrastructure security, including where AI intersects with it. This was a quiet week for verifiable, in-window stories. We found no confirmed incident or AI-related infrastructure development dated this week that met our sourcing bar, so this edition covers what we could verify: a cluster of CISA industrial control system (ICS) advisories. None of the items below involve AI, and none are reported as exploited.

OT/ICS Vulnerabilities & Defenses

Mitsubishi Electric and ICONICS SCADA software: some products will never be patched. CISA advisory ICSA-26-300-02 (Critical Manufacturing sector, worldwide) covers the GENESIS64 / ICONICS Suite family, used to build operator screens and data historians for plants. Flaws include a password-recovery weakness (CVE-2026-16436) in which the unlock challenge response is fixed and shared by all users, rated 8.1 (CVSS v3.1) and 9.2 (v4.0). Fixes exist for GENESIS and GENESIS64 (versions 11.04 and 10.98), but for MC Works64, GENESIS32, and BizViz, the advisory says no fix is planned and recommends migrating. The visible advisory text does not say whether any flaw is exploited. Why it matters: operators running end-of-life SCADA software are left relying on network isolation, which the advisory lists as a workaround alongside restricting logins to administrators.

Hitachi Energy TRO600 series: unauthenticated file read on energy-sector equipment. Advisory ICSA-26-302-02 (Energy, worldwide) describes CVE-2026-106087, which lets an attacker with no credentials read arbitrary files, including configuration and password data (CVSS v3.1 7.5). A second flaw (CVE-2026-10756) needs authentication. Hitachi recommends updating to 9.2.2.1. CISA reports no known exploitation. Stolen configuration and password data is the kind of foothold that makes later attacks on a substation or remote site easier, which is why the file-read bug deserves priority over its “High” rating.

Hitachi Energy CoreTec: command injection plus a Linux kernel privilege escalation. Advisory ICSA-26-302-03 (Energy, worldwide) lists an authenticated command-injection flaw (CVE-2026-13162) and a kernel flaw (CVE-2026-43284) that lets a local user become root; the top score is 8.8. CoreTec4 customers are told to move to CoreTec5 5.0.0. The advisory’s affected-version listing is internally inconsistent about 5.0.0, so confirm scope with Hitachi Energy. No known exploitation is reported.

EPICS Base: a critical flaw in widely used control-system software. Advisory ICSA-26-300-01 (Critical Manufacturing, worldwide) covers four flaws in EPICS Base 7.0.10 and earlier, including an integer overflow reachable through network requests (CVE-2026-114595, CVSS v3.1 9.8) that could cause a crash or possibly remote code execution. The fix is version 7.0.11. CISA has received no reports of public exploitation. The advisory does not describe EPICS’s purpose; it is an open-source toolkit for building distributed control systems, a point we are stating from general knowledge rather than from the advisory.

Siemens Mendix SAML module also received an advisory (ICSA-26-302-01) this week; we did not retrieve its details and so are not characterizing it.

Why This Matters / What to Watch

  • Patching is not always an option. The ICONICS-family products without fixes illustrate a common OT problem: the mitigation is segmentation and access control, not an update.
  • The common mitigation is the same every time. Every advisory above repeats the same advice: keep control systems off the internet, behind firewalls, separated from business networks, with up-to-date VPNs for remote access.
  • No exploitation reported does not mean low priority. Unauthenticated file read and network-reachable memory flaws tend to attract scanning once details are public.
  • AI context, not news. The most recent verified government warning of AI-assisted attacks on OT that we found, targeting Siemens S7 PLCs in water and other sectors, dates from late August and is outside this week’s window. We will report follow-ups when dated sources appear.
  • Sourcing caveat. CISA’s KEV additions this week (GitLab, Cisco ASA, Adobe Commerce, Brotli) have no stated infrastructure-specific impact, so we left them out.