Multiple High‑Severity Vulnerabilities in Eclipse Milo OPC‑UA Stack (CVE‑2026‑63252, CVE‑2026‑63248, CVE‑2026‑60007, CVE‑2026‑62927, CVE‑2026‑58080, CVE‑2026‑61387)
What It Is – The Eclipse Foundation’s Eclipse Milo library, used to build OPC‑UA servers for industrial control systems, contains five critical flaws (incorrect authorization, missing resource release, observable response discrepancy). Exploitation can delete protected data, recover user credentials, impersonate users, or cause a denial‑of‑service condition.
Exploitability – CVSS v3 base score 8.2 (High). Public advisories list the vulnerabilities; no public PoC is required for exploitation, and the flaws affect all deployed versions ≥ 0.6.0 ≤ 1.1.4.
Affected Products – Eclipse Milo library versions ≥ 0.6.0 ≤ 1.1.4 (all releases up to 1.1.4).
Why It Matters for Trust & Control Assurance
- Access‑control integrity – Missing or bypassable authorization checks break the control objective of “ensure only authorized entities can invoke privileged operations.”
- Evidence of due diligence – Continuous monitoring of library versions and patch status provides audit‑ready proof that the organization maintains a defensible security posture.
- Defensible audit trail – Documented remediation (patching, configuration review) satisfies multiple frameworks that map to the same VCF control objective, reinforcing trust with regulators and industrial partners.
Recommended Actions
- Apply the Eclipse Foundation’s patches for all listed CVEs immediately.
- Conduct a code‑review of any custom OPC‑UA handlers to verify proper authorization checks.
- Deploy a continuous‑monitoring rule that flags outdated Milo versions in your software‑bill‑of‑materials.
- Capture remediation evidence (patch logs, test results) in a centralized Trust Center for audit readiness.
Source: CISA Advisory – ICSA‑26‑288‑01