Vulnerability Spotlight: Vulnerabilities in Open Automation Software Platform could lead to information disclosure, denial of service

Summary: Cisco Talos discovered eight vulnerabilities in the Open Automation Software Platform, including TALOS-2022-1493 (CVE-2022-26082) with a severity score of 9.1 that could allow arbitrary code execution, and TALOS-2022-1513 (CVE-2022-26833) with a 9.4 score that could lead to unauthenticated use of the REST API. Other issues could expose directory listings, disclose platform usernames and passwords, cause denial of service and loss of communication, or let an attacker create security groups and user accounts, and Open Automation Software has released an update for version 16.00.0112.
What's compelling: One of these flaws hands an attacker a list of platform usernames and passwords, and another allows unauthenticated REST API use at a 9.4 severity score - on a platform built to move data between proprietary devices and applications.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-26026 CVE-2022-26043 CVE-2022-26067 CVE-2022-26077 CVE-2022-26082 CVE-2022-26303 CVE-2022-26833 CVE-2022-27169
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026