Daily OT Security News: October 26, 2026

Five recent developments for operational-technology and critical-infrastructure teams: vendor remediation, ransomware guidance, actively exploited software flaws, and a policy roundup. The items were originally published or updated from October 20 through October 26; several describe earlier fixes or observed activity, which are identified below. 1. CISA warns nine Kiloview E3 encoder vulnerabilities could fully compromise devices Source dates: CISA initial advisory: October 22, 2026. Kiloview firmware 1.30: released October 10 and listed on the vendor page October 12, before CISA’s disclosure. CISA’s October 22 advisory identifies nine vulnerabilities in Kiloview E3 NDI Encoder firmware earlier than 1.30 and warns that successful exploitation could fully compromise a device. Two command-injection flaws, CVE-2026-107861 and CVE-2026-110243, have CVSS v3.1 scores of 9.9; CVE-2026-109122, also command injection, scores 9.1. CISA classifies the remaining issues as three High and three Medium severity flaws, including a hard-coded token-signing secret, unauthenticated ONVIF operations and account disclosure, weak session expiration, path traversal, and an ONVIF service denial of service. Access requirements vary. The command-injection flaws require an authenticated web user with relevant permissions, while CVE-2026-92450 concerns a static…