High ICSA-26-288-01 6 CVEs

Eclipse Foundation Eclipse Milo

Published Oct 15, 2026 · Updated Oct 15, 2026

Vendor: Eclipse Foundation Product: Eclipse Milo

Summary

Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.

Vulnerabilities 6

Critical 9.1

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA …

Eclipse Foundation Eclipse Milo

Aug 4, 2026
High 8.8

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. O…

Eclipse Foundation Eclipse Milo

Aug 4, 2026
High 8.7

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space han…

Eclipse Foundation Eclipse Milo

Aug 4, 2026
High 8.7

CVE-2026-63252

In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message c…

Eclipse Foundation Eclipse Milo

Aug 4, 2026
Medium 6.9

CVE-2026-61387

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation f…

Eclipse Foundation Eclipse Milo

Aug 4, 2026
Medium 6.9

CVE-2026-63248

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An a…

Eclipse Foundation Eclipse Milo

Aug 4, 2026

Revision history

2026-10-15 #1
Initial Publication

References

ICSA Advisory ICSA-26-288-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
Recommended Practices
https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
Recommended Practices
https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks