The Operational Technology Information Sharing and Analysis Center (OT-ISAC) released a comprehensive vulnerability advisory on April 20, 2026, detailing critical security flaws across a wide range of industrial control systems (ICS). The report consolidates multiple disclosures from April 2026, identifying systemic risks in legacy field controllers, programmable logic controller (PLC) ecosystems, industrial wireless infrastructure, and network management platforms. While no active exploitation of these specific flaws was reported at the time of publication, OT-ISAC characterized the overall risk level as high due to the potential for unauthenticated access and protocol abuse in critical infrastructure.
A significant portion of the advisory focuses on legacy and obsolete hardware that remains prevalent in industrial environments. Specifically, the report identifies the BASControl20 controller as having critical vulnerabilities with no available fixes, leaving these devices exposed to unauthenticated access. Additionally, Horner Automation’s XL4 and XL7 devices, utilizing Cscape software, were found to have weak password protections and vulnerabilities in their login workflows. OT-ISAC warned that these legacy systems are often difficult to patch or replace, creating persistent entry points for threat actors.
The advisory also highlights critical management-plane vulnerabilities within Siemens industrial networking products. Affected services include the SINEC Network Management System (NMS), RUGGEDCOM devices, and Industrial Edge management components. These flaws could allow for credential compromise or unauthorized configuration changes, potentially granting attackers control over entire industrial network segments. Security teams are advised to monitor for anomalous administration behavior and repeated login failures within these platforms.
In the software domain, OT-ISAC disclosed authorization bypass flaws in AVEVA pipeline simulation software. This vulnerability could allow unauthorized users to manipulate simulation data or gain access to sensitive operational logic. Furthermore, the advisory noted risks in OT-adjacent systems, such as the Anviz CX2 Lite and CrossChex physical access control platforms. These systems, while not directly controlling industrial processes, can influence site security and incident response capabilities if compromised.
The operational impact of these vulnerabilities spans process safety, industrial communications, and engineering workstations. OT-ISAC emphasized that the likelihood of exploitation is strongly tied to network exposure and the use of legacy deployments. The organization recommends that operators prioritize patching where possible, isolate or replace unsupported hardware, and enforce multi-factor authentication for all remote-access pathways. The advisory also suggests strengthening monitoring around management interfaces to detect forged requests or unusual file transfer activity, particularly involving BACnet/IP and Modbus protocols. This consolidated risk view reflects a growing trend of targeting internet-exposed operational technology assets, which has seen an escalation in activity throughout the first half of 2026.