Daily OT Security News: October 16, 2026

This edition covers five source-verified OT, IoT, and critical-infrastructure cybersecurity developments. Source dates are identified below. Confirmed advisory facts, reported claims, and policy or framework updates are distinguished throughout. 1. Eclipse Milo flaws could expose OPC UA data or credentials, bypass authorization, or disrupt servers CISA published ICSA-26-288-01 on October 15, 2026, warning that Eclipse Foundation’s Milo OPC UA stack has six listed CVEs: CVE-2026-63252, CVE-2026-63248, CVE-2026-60007, CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387. The CISA header says five vulnerabilities even though the advisory lists six CVE identifiers. CISA identifies chemical, critical manufacturing, energy, and water/wastewater as relevant sectors. 1 Affected ranges are 0.6.0–1.1.4 for CVE-2026-63252, CVE-2026-63248, and CVE-2026-60007, and 1.0.0–1.1.4 for CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387. Potential outcomes across the listed flaws include protected-data deletion, credential or session-information exposure/recovery and impersonation, authorization bypass, and server nonresponse. 1 Prerequisites differ. CVE-2026-60007 is a Basic128Rsa15 username-token padding oracle: an on-path attacker must capture a victim token, then make repeated unauthenticated ActivateSession requests; its CVSS v4.0 score is 9.1 Critical. 2 CVE-2026-58080 concerns a RoleMapper dropped by OpcUaServerConfig.copy(); role checks may be skipped where a server relies on RoleMapper and permits anonymous sessions; CVSS v4.0 is 8.8 High. 3 CVE-2026-62927 may let an anonymous or low-privileged…