CISA issues seven new ICS advisories, critical flaw in Siemens building automation

On 28 July 2026, CISA published seven new security advisories for industrial control systems. The advisories cover four Siemens products, MikroTik RouterOS, the igloohome smart lock mobile application and ABB's update tool for KNX. The most severe is a vulnerability in the Siemens Desigo CC building automation platform, rated 9.8 out of 10 on the CVSS scale. For several of the weaknesses in Siemens SIMATIC S7-1500, CISA states that no fix is currently available.

What happens technically

The Desigo CC vulnerability (CVE-2025-15467) is an out-of-bounds write. This is a class of flaw where a program can be made to write data to memory locations it should not touch, and in the worst case such flaws can be used to run the attacker's own code. The vector CISA provides indicates that the attack can be carried out over the network, without prior authentication and without any user action. Mendix Runtime, Siemens' platform for low-code applications, has a permissions weakness rated 9.1 (CVE-2026-7891). The MikroTik vulnerability (CVE-2026-16347, rated 8.8) lets an attacker on the same network guess passwords at high speed and gain unauthorised access to the system.

The advisory for the SIMATIC S7-1500 CPU 1518 stands out in a different way. It collects a number of known vulnerabilities in the software components the controller is built on, and for several of them CISA states that a fix is not yet available. That situation is not unusual in industrial environments. The equipment lives for decades, and updates often have to wait for planned maintenance windows. Compensating controls then matter more than patching. The two remaining advisories concern access control in the igloohome smart lock app (rated 5.3) and a missing integrity check in ABB's update tool for KNX-based building systems (rated 6.4).

What this means for you if you are responsible for OT equipment

Today's advisories reach wider than classic industry. Building automation, access control and network equipment sit in technical rooms at organisations in most sectors, and these systems are often operated outside the IT department's field of view. If you run a platform that controls ventilation, access and alarms, that is operational technology. In our judgement it deserves the same seriousness as the production systems. The NIS2 directive makes this kind of risk management a leadership responsibility for essential and important entities.

The most important message for you in today's advisories, in our reading, is that several weaknesses currently have no fix. Where you cannot patch, the risk has to be handled with architecture. That means segmentation separating the OT network from the office network, strict access control and monitoring that catches abnormal activity. If you do not know which of these products you run, you cannot judge whether you are affected. An inventory of your own systems is therefore your first measure, not your last.

Berigo recommends

• Map whether your organisation uses affected products, including building automation and access control operated by third parties.
• Read the CISA advisories for the products you have, and prioritise Desigo CC and MikroTik by severity.
• Upgrade where a fix exists, and schedule it into the first possible maintenance window.
• Where a fix is missing, introduce compensating controls: segmentation, minimal network exposure and sharpened monitoring.
• Clarify with operations and building suppliers who is responsible for updating the OT equipment.