iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
September 2026’s “ICS Patch Tuesday” was a cross-vendor roundup, not a coordinated release: Siemens, Schneider Electric and AVEVA advisories were covered together on September 9, while CISA published separate batches on September 10, 15 and 22. To determine whether your equipment is affected, check the exact product and version in its vendor advisory; the roundup is a guide to those notices, not a site-specific asset assessment or patch sequence.
What was published in the September 2026 roundup?
SecurityWeek’s September 9 roundup reported new and updated notices from Schneider Electric and Siemens, as well as an AVEVA vulnerability. The counts below describe notices reported in that article, not a complete inventory of every advisory issued in September.
| Publisher | What the September 9 roundup reported |
|---|---|
| Schneider Electric | Four new security advisories and four updates to existing advisories. Highlighted products included Modicon M580 and M580 Safety controllers, PowerLogic T300, EcoStruxure IT Data Center Expert, SCADAPack x70 and Modicon MC80. |
| Siemens | Nine new advisories since the previous Patch Tuesday, including seven published September 8, and nine advisory updates. Highlighted products included Reyrolle 7SR5, Open Interface Services, Industrial Edge Management, SIMOVE Fleetmanager/SIPLANT, Desigo CC, Teamcenter, the Mendix SAML module and Element Maps. |
| AVEVA | A medium-severity unsafe-deserialization flaw in Enterprise SCADA that could potentially lead to remote code execution. |
These highlights and counts were reported by SecurityWeek on September 9, 2026. A roundup-level description does not establish whether a particular installation is vulnerable or which fix applies.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which issues and fixes should operators check first?
Schneider Electric: Modicon controllers and other products
SecurityWeek identified CVE-2026-3869 as a critical authentication flaw in Modicon M580 and M580 Safety controllers, reporting a CVSS score of 9.2. It also highlighted high-severity issues affecting PowerLogic T300 and EcoStruxure IT Data Center Expert, and a medium-severity issue affecting SCADAPack x70. Four updated Schneider advisories reportedly added patches being rolled out for the Modicon MC80 controller. These are summaries from SecurityWeek, not a substitute for the applicable Schneider advisory’s affected-version list and remediation instructions.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
Siemens: fix status varies by product
Siemens ProductCERT advisory SSA-328642, “Copy Fail” Vulnerability in Multiple Industrial Products, was published and last updated September 8, 2026. Its current version is V1.0, and its stated CVSS v3.1 base score is 7.8. Siemens says it released new versions for several affected products, was preparing further fixes for others, and provided countermeasures where fixes were not yet available. The advisory lists affected products and versions individually; one product’s fix status should not be applied to the rest of the Siemens portfolio. Consult Siemens ProductCERT advisory SSA-328642 for the product-specific details.
The roundup also called out critical-severity issues involving Reyrolle 7SR5, Open Interface Services, Industrial Edge Management and SIMOVE Fleetmanager/SIPLANT, plus high-severity issues in Desigo CC, Teamcenter, the Mendix SAML module and Element Maps. Those labels help locate the notices; use each Siemens advisory to confirm its scope, versions, fix and mitigation.
AVEVA: Enterprise SCADA
AVEVA warned of a medium-severity unsafe-deserialization vulnerability in Enterprise SCADA that could potentially enable remote code execution, according to SecurityWeek. The roundup does not establish affected versions or a remediation for this issue. Check the relevant AVEVA security bulletin for those details before deciding whether or how to change an installation.
What did CISA publish separately?
CISA’s ICS advisories arrived in separate batches rather than as one simultaneous Patch Tuesday release. CISA published four advisories on September 10, eight on September 15, and nine on September 22, 2026. The September 15 batch included Schneider Electric SCADAPack x70 and Siemens Reyrolle 7SR5; the September 22 batch included Siemens Siveillance Control, SIPLUS and SIMATIC products, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager/SIPLANT. The agency’s bulletins are indexes: consult each linked notice for technical details and mitigation instructions.
AVEVA Pipeline Integrity Monitor: a CISA-hosted example
CISA’s September 10 release included ICSA-26-253-01 for AVEVA Pipeline Integrity Monitor. Its CSAF record identifies it as an initial republication of AVEVA security bulletin AVEVA-2026-006. The record lists affected versions through 2025_SP1_P1_build_7.1.9580.8513 and describes risks involving PIMBoards project files, including exposure of sensitive information and password-related weaknesses.
The listed remediation is not just an update: apply AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update, migrate old project files, require PIMBoards users to change passwords, and restrict read access to unsafe files that cannot be migrated. Migration is one-way, so review the vendor’s instructions and assess the operational implications before migrating project files. See CISA advisory ICSA-26-253-01 for the record and remediation details.
Rank #4
How to check whether your product and version are affected
- Identify the exact asset. Record its product name, model, installed version or build, and relevant configuration. A product family name alone may not be enough to match an advisory’s scope.
- Open the matching primary advisory. Use the vendor’s notice for the product, and compare your installed version with its affected and fixed versions. For CISA-listed notices, follow the bulletin to the underlying technical details and mitigation.
- Read the remedy and its conditions. Confirm whether the notice calls for a software update, workaround, configuration change, password change or other action. Check for prerequisites, unavailable fixes, and consequences such as one-way project-file migration.
- Assess the change against site conditions. Validate the proposed action against local operational, safety and change-control requirements. A general roundup cannot determine a safe maintenance window or patch order for a particular control system.
Why the label “ICS Patch Tuesday” needs qualification
Here, “Patch Tuesday” is shorthand for a cross-vendor advisory cycle. It does not mean Siemens, Schneider Electric, AVEVA and CISA jointly coordinated a release. SecurityWeek’s roundup appeared September 9; CISA’s separate publication batches followed on September 10, 15 and 22. CISA’s September 15 and 22 bulletins also direct users and administrators to the individual advisories for technical details and mitigations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The September 22 CISA bulletin is the latest batch covered here; this account does not establish that it is the final ICS notice issued during September. Likewise, the highlighted advisories are not an exhaustive inventory across all named organizations. For current coverage, check each organization’s advisory feed and verify the affected versions and instructions in the primary notice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
