Published advisories
When we resolve a reported security issue, we publish an advisory here (identifier ESA-YYYY-NNN) so customers can assess their exposure and upgrade. Advisories are listed newest first.
ESA-2026-009
Published 2026-10-20
Bundled Microsoft .NET components with known denial-of-service vulnerabilities
- Affected versions
- Versions before 2026-10-20 Patch 2
- Fixed in
- 2026-10-20 Patch 2
- Impact
- High
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CVE-2026-84008 and CVE-2026-96958 as rated by Microsoft
- Mitigation
- Update to version 2026-10-20 Patch 2 or later. No configuration change is required after updating. The setup installs the ASP.NET Core Hosting Bundle 10.0.13, which contains Microsoft's fixes of the .NET 10.0.13 security release, among them CVE-2026-96958 in System.Security.Cryptography.Xml, and the application ships System.Security.Cryptography.Pkcs 10.0.13, which fixes CVE-2026-84008 and CVE-2026-70162. The setup asks to restart the computer, so plan an upgrade window, on both nodes of a redundant pair. EnvisionSCADA does not call the affected functions itself; the update removes the vulnerable versions from the installation. Until the update is installed, install the ASP.NET Core Hosting Bundle 10.0.13 from Microsoft on the server and allow only trusted clients to reach the EnvisionSCADA web server.
- Credit
- Internal security review
ESA-2026-008
Published 2026-10-06
Alarm Banner could run script from alarm texts and acknowledge comments
- Affected versions
- Versions before 2026-10-06
- Fixed in
- 2026-10-06
- Impact
- High
- CVSS
- 8.2 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L)
- Mitigation
- Update to version 2026-10-06 or later. No configuration change is required after updating. After the update, the Alarm Banner shows alarm messages, assets and acknowledge comments as plain text, so markup in these texts is displayed as typed. Until the update is installed, grant the Alarm Acknowledge Right only to trusted users.
- Credit
- Internal security review
ESA-2026-007
Published 2026-10-06
Trend data, variable lists and recipes could be read without logging in
- Affected versions
- Versions before 2026-10-06
- Fixed in
- 2026-10-06
- Impact
- High
- CVSS
- 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
- Mitigation
- Update to version 2026-10-06 or later. No configuration change is required after updating. Until the update is installed, allow only trusted clients to reach the EnvisionSCADA web server, for example with a firewall rule, and do not expose the web server to untrusted networks.
- Credit
- Internal security review
ESA-2026-006
Published 2026-08-08
A Development environment setting on the server could expose error details
- Affected versions
- Versions before 2026-08-08
- Fixed in
- 2026-08-08
- Impact
- Medium
- CVSS
- 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N)
- Mitigation
- Update to version 2026-08-08 or later. An installed build now always runs as Production, so the ASPNETCORE_ENVIRONMENT value on the server can no longer change how errors are reported. No configuration change is required after updating. As a precaution, check whether ASPNETCORE_ENVIRONMENT is set to Development on the server, in the IIS application pool, or in the shell used to start the service, and remove it if it is not needed.
- Credit
- Internal security review
ESA-2026-005
Published 2026-07-14
Residual SQL injection in device template lookups and list sorting
- Affected versions
- Versions before 2026-07-14
- Fixed in
- 2026-07-14
- Impact
- Medium
- CVSS
- 6.4 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
- Mitigation
- Update to version 2026-07-14 or later. No configuration change is required after updating. This is a follow-up to ESA-2026-002 that hardens two remaining query paths of the same class.
- Credit
- Internal security review
ESA-2026-004
Published 2026-07-14
Redundancy synchronization channel lacked mutual authentication
- Affected versions
- Versions before 2026-07-14
- Fixed in
- 2026-07-14
- Impact
- High
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Mitigation
- Update to version 2026-07-14 or later. After updating, set a Redundancy Shared Secret with the same value on both nodes in the redundancy settings to require authenticated synchronization, and keep the redundancy link on a dedicated, isolated network. Existing pairs continue to operate on the previous behaviour until the secret is configured.
- Credit
- Internal security review
ESA-2026-003
Published 2026-07-14
Project and library import could write files outside the intended folder
- Affected versions
- Versions before 2026-07-14
- Fixed in
- 2026-07-14
- Impact
- High
- CVSS
- 7.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- Mitigation
- Update to version 2026-07-14 or later. No configuration change is required after updating. Importing projects and libraries remains restricted to administrators; continue to import archives only from trusted sources.
- Credit
- Internal security review
ESA-2026-002
Published 2026-07-14
Configuration and historian search filters could allow SQL injection
- Affected versions
- Versions before 2026-07-14
- Fixed in
- 2026-07-14
- Impact
- High
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
- Mitigation
- Update to version 2026-07-14 or later. No configuration change is required after updating. As a general precaution on systems that were reachable by untrusted or Guest users, review user accounts and rotate credentials.
- Credit
- Internal security review
ESA-2026-001
Published 2026-07-14
Database Query tool could access databases outside its intended scope
- Affected versions
- Versions before 2026-07-14
- Fixed in
- 2026-07-14
- Impact
- High
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
- Mitigation
- Update to version 2026-07-14 or later. After updating, review the Database Query Access settings on the Parameters page and list only the databases the project requires. Keep Allow all databases cleared unless unrestricted access is required.
- Credit
- Internal security review