Why it matters now: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has refreshed its CISA ICS advisory coverage for some of the most widely deployed power and automation platforms on earth. Advisory ICSA-26-169-07 republishes Schneider Electric's update for an “Insufficient Entropy” weakness spanning the Easergy, EcoStruxure, PowerLogic and Saitel product families. Two companion advisories issued in the same cycle flag the IXON VPN Client and the OPC Foundation's OPC UA LocalDiscoveryServer (LDS) — the connectivity layers that link PLCs, RTUs and SCADA systems. For plant engineers, the message is blunt: the edge of the control network, not the controller itself, is frequently the weakest link.
Analyst Insight: Three advisories in one cycle touching discovery services, remote-access clients and power-automation endpoints is not a coincidence. It reflects how tightly coupled the modern automation stack has become. Defenders should treat OPC UA servers and remote-access gateways as Tier-0 assets, applying the same rigor historically reserved for domain controllers.
The Big Picture: Connectivity Layers Are the New Attack Surface
Modern industrial operations no longer stop at the PLC. Data flows upward through OPC UA servers, remote-access gateways and engineering workstations into cloud dashboards and enterprise systems. Each hop is an opportunity for lateral movement.
CISA's latest batch of advisories reinforces a pattern OT security teams have tracked for years: the tools that make modern and legacy PLC fleets reachable are increasingly the tools that make them breachable. OPC UA and VPN clients are effectively the front door to whole controller fleets.
Advisory Snapshot: Vendors, CVEs and Severity Scores
| Advisory |
Vendor / Product |
CVE |
CVSS |
Weakness |
| ICSA-26-169-07 (Update A) |
Schneider Electric — Easergy, EcoStruxure, PowerLogic, Saitel |
CVE-2026-4827 |
8.3 (HIGH) |
Insufficient Entropy (CWE-331) |
| ICSA-26-246-01 |
OPC Foundation — OPC UA LocalDiscoveryServer (LDS) |
CVE-2026-77477 |
4.6 (MEDIUM) |
Execution with Unnecessary Privileges (CWE-250) |
| ICSA-26-246-02 |
IXON — VPN Client |
CVE-2026-75925 |
9.6 (CRITICAL) |
Improper Neutralization of CRLF Sequences (CWE-93) |
CISA has reported no known public exploitation specifically targeting these issues at the time of publication.
Schneider Electric: Insufficient Entropy Across Power Automation Platforms
Schneider Electric's advisory — republished by CISA as ICSA-26-169-07 (Update A) and drawn from the vendor's CPCERT notification SEVD-2026-132-02 — describes an “Insufficient Entropy” flaw rated 8.3 (HIGH). Weak randomness in cryptographic or session operations can allow attackers to predict values that are supposed to be unpredictable.
The affected portfolio is broad: Easergy protection relays and RTUs, EcoStruxure software and edge platforms, PowerLogic power meters, and the Saitel RTU line. This is hardware that sits directly adjacent to PLC-based control systems across energy, water and manufacturing environments.
What ‘Insufficient Entropy’ Actually Means for an RTU or Relay
Entropy is the randomness that seeds keys, tokens, nonces and session identifiers. When a device generates predictable values, an attacker who observes enough samples may guess future ones.
In industrial devices, weak entropy can erode:
- Authentication tokens and session cookies served by embedded web interfaces
- Cryptographic key generation for TLS or signed firmware
- Device or message identifiers used in telemetry and protocol handshakes
Mitigation typically requires a vendor firmware update. Where no patch exists, network segmentation and stricter access controls are the interim safeguards.
Market Trend: Power-automation endpoints are no longer air-gapped. As utilities and manufacturers push telemetry into the cloud, devices once reachable only from a substation LAN now speak to enterprise and SaaS systems. That architectural shift amplifies the practical impact of cryptographic weaknesses like insufficient entropy.
OPC UA LocalDiscoveryServer: A Small Score With Real Exposure
The OPC Foundation's flaw, tracked as CVE-2026-77477 in advisory ICSA-26-246-01, scores a modest 4.6 (MEDIUM) on CVSS 3.1 and 2.4 on CVSS 4.0. The weakness — Execution with Unnecessary Privileges (CWE-250) — affects UA-LDS installers before version 1.04.420.
The attack path is local rather than remote: an attacker must intercept a high-privilege console window launched during installation, requiring installer rights plus keyboard and display access. Rockwell Automation's Lukas Schumaker reported the issue, and the OPC Foundation relayed it to CISA.
Why the LDS Discovery Service Matters in a PLC Architecture
The Local Discovery Server is the directory that lets OPC UA clients find servers and endpoints across a network. In many plants, it is a foundational — and often overlooked — piece of the OT connectivity stack.
Because discovery services map the network's OPC UA topology, they are valuable reconnaissance targets. Even a lower-severity privilege flaw on a discovery host can aid an attacker who already has local access and is moving laterally.
The affected sectors listed by CISA include Chemical, Energy, Food and Agriculture, Water and Wastewater, and Critical Manufacturing.
IXON VPN Client: When Remote Access Becomes the Attack Path
The most severe item in the set is the IXON VPN Client advisory (ICSA-26-246-02), which carries a 9.6 CRITICAL rating. CVE-2026-75925 is an improper neutralization of CRLF sequences affecting VPN Client versions before 1.4.7.
According to the advisory, successful exploitation could allow an attacker to perform remote code execution on the computer running the client with elevated privileges. Because the injected configuration can persist across reboots with little visible change, detection without active forensic review is unlikely.
Installations on Linux and macOS were previously touched by a separate local privilege-escalation issue, CVE-2025-26168, reinforcing that remote-access software is a recurring weak point. CISA lists no known public exploitation of CVE-2026-75925 at this time.
Analyst Insight: A critical remote-code-execution flaw in a VPN client is a worst-case scenario for OT. The same tunnel organizations rely on for secure remote maintenance can become the vector for privileged compromise of every endpoint it reaches. Patch VPN clients with the urgency of an internet-facing service, because that is effectively what they are.
Remediation Playbook for OT and PLC Teams
The common thread across all three advisories is that connectivity software needs the same vulnerability discipline as controllers. CISA's standing guidance for ICS assets maps directly onto this cycle.
CISA-Recommended Defensive Measures
- Minimize network exposure: ensure control-system devices are not directly reachable from the internet.
- Place control networks and remote devices behind firewalls, isolated from business networks.
- Where remote access is required, use secure VPNs — and keep them updated to the latest version.
- Apply vendor firmware and software updates, and validate backups before upgrading.
- Perform proper impact analysis and risk assessment before deploying defensive measures in live OT environments.
- Have a documented incident-response plan, and report suspected malicious activity to CISA for correlation.
Frequently Asked Questions
Do these advisories affect PLCs directly?
Not the PLC firmware itself. The advisories target adjacent layers — power-automation endpoints, a discovery service and a remote-access client — that connect to and manage PLC fleets. Compromise of these layers can still expose controllers to lateral movement and unauthorized manipulation.
Which vulnerability should be prioritized first?
The IXON VPN Client flaw (CVE-2026-75925) carries the highest rating at 9.6 CRITICAL and enables remote code execution with elevated privileges. Next in line is Schneider Electric's 8.3 HIGH insufficient-entropy issue, given the breadth of affected hardware.
Are these vulnerabilities being actively exploited?
As of publication, CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported. That status can change, and past ICS incidents show the window between disclosure and exploitation is often short.
What is the common thread analysts should take away?
Connectivity is the risk. Discovery services, remote-access tools and edge platforms are now as security-critical as the controllers they serve. Treating them as first-class OT assets — inventoried, patched and segmented — is the most durable takeaway from this advisory cycle.
