Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
February 2026’s ICS security disclosures covered products from Siemens, Schneider Electric, AVEVA and Phoenix Contact. The reported risks included denial of service, information exposure, unauthorized access, cross-site scripting, code execution and privilege escalation. The details below are a snapshot of disclosures reported around February 10–11, 2026—not a current inventory of these vendors’ vulnerabilities. Check the applicable vendor advisory for the exact affected build and available fix or mitigation before acting.
What the February disclosures covered
SecurityWeek’s February 11 roundup reported eight new Siemens advisories, two high-severity Schneider Electric issues affecting EcoStruxure Building Operation, and a critical SCADAPack issue. It also covered two AVEVA bulletins and a Phoenix Contact advisory concerning a 2024 OpenSSL vulnerability. These are roundup-level descriptions: they do not provide a complete CVE-by-CVE account or establish that every product named below is affected in the same way.
| Vendor | Products or advisory scope reported | Reported impact or severity |
|---|---|---|
| Siemens | Desigo CC, SENTRON Powermanager, Simcenter Femap and Nastran, NX, SINEC NMS, Solid Edge, Polarion, Siveillance Video Management Servers; the Canadian Centre for Cyber Security also lists SIPORT Desktop Client and SINEC NMS User Management Component. | SecurityWeek described high-severity issues across the named product families and a medium-severity Siveillance issue. Reported outcomes included unauthorized access, cross-site scripting, denial of service, code execution and privilege escalation. |
| Schneider Electric | EcoStruxure Building Operation Workstation and WebStation; SCADAPack RTUs and related products. | SecurityWeek reported denial of service, information disclosure or code execution for the EcoStruxure issues, and denial of service or code execution for the critical SCADAPack issue. |
| AVEVA | PI Data Archive; PI to CONNECT Agent. | SecurityWeek characterized the PI Data Archive issue as high severity and denial of service, and the PI to CONNECT Agent issue as medium severity and unauthorized access. |
| Phoenix Contact | An advisory addressing a 2024 OpenSSL vulnerability; the February roundup material does not establish affected product models. | Specific affected products, CVE and fixed firmware are not established in the February roundup material. |
Siemens: check the named product families and versions
SecurityWeek reported eight new Siemens advisories. Its roundup identifies issues in Desigo CC, SENTRON Powermanager, Simcenter Femap and Nastran, NX, SINEC NMS, Solid Edge and Polarion, plus a medium-severity issue in Siveillance Video Management Servers. The Canadian Centre for Cyber Security’s February 10 alert also names SIPORT Desktop Client and the SINEC NMS User Management Component, and specifies Polarion V2404 and V2410.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Canadian alert gives selected version boundaries: Simcenter Femap and Nastran and NX before V2512; Solid Edge before V226.00 Update 03; Polarion V2404 before V2404.5; and Polarion V2410 before V2410.2. These examples are not a substitute for checking each affected component and CVE in the relevant Siemens ProductCERT advisory. Siemens says its ProductCERT advisories are intended to help customers assess vulnerability impact and determine customer action.
#1 Best Overall
Schneider Electric: use the version cutoffs in the notices
SecurityWeek reported two high-severity vulnerabilities in EcoStruxure Building Operation Workstation and WebStation, with possible denial of service, information disclosure or code execution. It also reported a critical SCADAPack RTU issue that could lead to denial of service or code execution. Schneider’s notification index identifies CVE-2026-1226 and CVE-2026-1227 for EcoStruxure Building Operation Workstation and WebStation, and CVE-2026-0667 under “Improper Check for Unusual or Exceptional Conditions on Multiple Products.”
The Canadian Centre for Cyber Security’s February 11 notice lists these affected-version boundaries:
- EcoStruxure Building Operation 7.0.x before 7.0.3.2000 (CP1), and 6.x before 6.0.4.14001 (CP10).
- SCADAPack 47x/47xi before R3.4.2, with firmware before 9.12.2.
- All SCADAPack 57x versions.
- RemoteConnect before R3.4.2.
Confirm the precise product applicability and the vendor’s prescribed action in Schneider Electric’s notice; the affected-version list alone does not establish the right remediation for a particular installation.
AVEVA: note the PI products and configuration condition
AVEVA’s security update page lists two bulletins dated February 10, 2026:
- AVEVA-2026-002: PI Data Archive, covering PI Server versions 2024, 2023 Patch 1, 2023, 2018 SP3 Patch 7, and prior. SecurityWeek described this as a high-severity denial-of-service vulnerability.
- AVEVA-2026-003: PI to CONNECT Agent v2.4.2520 and earlier when using a proxy with credentials in the proxy URI. SecurityWeek described this as a medium-severity unauthorized-access issue.
CISA’s February 10 bulletin also lists both products among that day’s ICS advisories. Consult the individual AVEVA bulletins for the technical details and remediation that apply to the installed version and configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Phoenix Contact: verify the advisory before identifying affected equipment
SecurityWeek said Phoenix Contact issued an advisory addressing a 2024 OpenSSL vulnerability. The February roundup does not establish the affected Phoenix Contact models, the precise CVE or the fixed firmware release, so those details should not be inferred from the OpenSSL reference alone. Phoenix Contact’s PSIRT page explains that its team publishes advisories for confirmed product vulnerabilities when mitigations or fixes are available; use the specific advisory to identify any affected equipment and action.
Quick Recap
Best Value
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
How to use this February snapshot safely
- Identify installed products and exact builds. Match the product name, component and version—not just the vendor or product family—to the affected-version details in the relevant vendor advisory.
- Read the matching advisory for the CVE and action. Roundup summaries and government alerts help identify issues to investigate, but the vendor notice is the place to confirm exact applicability, available updates and mitigations.
- Assess operational requirements before applying changes. The cited sources do not provide one universal deployment sequence for these different OT products. Follow the product-specific vendor instructions and applicable operational controls.
- Check for newer notices as well. This is a February release snapshot. Later 2026 advisories appeared from these vendors; Phoenix Contact’s PSIRT index, for example, includes notices dated September 16 and August 12, 2026. CISA also issued later bulletins listing Siemens and Schneider Electric products.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
