CISA Drops Six ICS and Medical Advisories in a Day

Start at threat-intelligence.redeyesecurity.com. The KEV fast lane there is free and publishes every catalog addition the day CISA makes it, next to the CVE Index that says whether a detection ships for it. This post starts with the six advisories CISA published this week, because they are a clean picture of what the OT attack surface looks like now, and ends with what BOD 26-04 requires the morning one of them becomes a KEV entry.

What CISA Published on October 15

Christopher Warner, an OT and ICS security strategist, made the point on LinkedIn within hours of the release: this list is a good example of how far the definition of the OT attack surface has moved. Not controllers on a plant floor. Industrial applications, OPC UA components, IoT, networking equipment and medical systems. Here is what each advisory says, from CISA's own pages.

• CISA Malcolm, ICSA-26-280-01 (Update A, October 15). CISA's own open-source network traffic analysis suite, versions 26.07.1 and 26.08.0 and earlier. Seven CVEs, top CVSS v3.1 8.1. A case-sensitive nginx rewrite lets requests skip authentication and reach Arkime with a forged user header (CVE-2026-107336), a path normalization mismatch opens admin endpoints to any authenticated user (CVE-2026-107333), the bundled FilePond server will fetch arbitrary URLs (CVE-2026-107362), and an unauthenticated endpoint with wildcard CORS can wipe captured traffic from a cross-site request (CVE-2026-107337). Fixed in 26.08.0 and 26.09.0 depending on the CVE. Credit: Seth Grover, Idaho National Laboratory. Sectors: Energy, IT, Water and Wastewater.
• Eclipse Foundation Eclipse Milo, ICSA-26-288-01. The OPC UA stack embedded in a great deal of industrial software, 0.6.0 through 1.1.4. Six CVEs, top CVSS v3.1 8.2 and v4 9.1. Batching a denied method call with an allowed one runs it anyway (CVE-2026-62927), a configuration copy drops the role mapper and with it every permission check (CVE-2026-58080), and a padding oracle in username-token handling can recover passwords (CVE-2026-60007). Fixed in 1.1.5; there is no patched 0.6.x. Credit: Abhinav Agarwal. Sectors: Chemical, Critical Manufacturing, Energy, Water.
• Guangzhou Juan IoT EseeCloud, ICSA-26-288-02. IP camera app 4.9.6 and firmware 4.9.86.0 and earlier. Three CVEs, led by a hard-coded credential that logs an attacker into the device (CVE-2026-107617, CVSS v3.1 9.8), plus a rebind flaw that moves a camera from its owner to the attacker's account (CVE-2026-97858) and a response discrepancy that enumerates registered devices at scale (CVE-2026-105664). The vendor did not respond to CISA. There is no fix. Credit: Donghyeon Lee, Tokyo University of Science and GMO Flatt Security. Sectors: Communications, Energy, Financial Services, Government Facilities, Transportation.
• Red Lion Controls N-Tron 700 Series, ICSA-26-281-01 (Update A). Industrial Ethernet switches, firmware 3.11.0 and bootloader 2.0.6.1 and earlier. Seven CVEs, top CVSS v3.1 8.3 and v4 9.3. SNMP performs administrative actions without authentication, including retrieving the configuration and changing accounts or firmware (CVE-2026-33367); that configuration holds usernames and passwords in plaintext and SNMP can trigger a TFTP export of it (CVE-2026-39460); firmware and bootloader updates need no authentication or integrity check (CVE-2026-29797); one web URL reboots the switch (CVE-2026-39453). Fixed in 3.11.1. Update A revised the v4 scores and repaired links. Credit: Gabrianna Milloway, Idaho National Laboratory. Sectors: Commercial Facilities, Communications, Critical Manufacturing, IT.

Four advisories, twenty three CVEs, four fixes and one vendor that never answered. No public exploitation reported to CISA for any of them. Then the two medical advisories, which deserve the closest read.

The Two Medical Advisories

J4Care dcm4che, ICSMA-26-288-02. dcm4chee-arc-light 5.35.1 is an open-source DICOM archive, the PACS back end that stores and serves medical images in hospitals, imaging centers and research networks worldwide. Six CVEs, all network reachable with low complexity and no credentials, top CVSS v3.1 9.1 and v4 9.3. The two that matter most are configuration defaults: the archive accepts DICOM associations from callers it has never registered, so patient data and images can be retrieved and fabricated studies stored (CVE-2026-105279), and the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender, and the unmerge does not reverse the change (CVE-2026-105667). A missing authorization check lets location records be flipped to a deletion state so the referenced image files are purged from storage (CVE-2026-97851). Three more are parser denial of service in the JPEG, MP4 and multipart handlers. CISA's risk statement is unusually direct: an attacker could delete stored medical images, disclose patient information and inject forged studies. Fixed in 5.35.2. Credit: Abhinav Agarwal.

Thermo Fisher Torrent Suite Software, ICSMA-26-288-01. The analysis software for Ion Torrent genomic sequencers, versions 5.18 and earlier. One CVE, a path traversal that lets an authenticated user read any file on the Torrent Server the web service account can reach (CVE-2026-107777, CVSS v4 7.1, v3.1 6.5). Lower score, but the files on that server are sequencing runs, sample manifests and the service credentials around them. Fixed in 5.22. Credit: Akanksha Raghvesh and Abhinav Agarwal.

None of These Is in KEV. That Is the Point.

We checked the catalog CISA published at 17:00 UTC on October 15: 1,746 entries, 36 of them added in the last thirty days, and none of the thirty CVEs above among them. That will not hold for all six. EseeCloud has no vendor fix and a hard-coded credential, the N-Tron switch takes unauthenticated firmware over SNMP, and dcm4che takes unauthenticated DICOM by default. Those are the shapes that show up in the catalog weeks after the advisory, once someone scans for them.

Under BOD 22-01 that catalog entry carried a due date and the work was patching. Under BOD 26-04 the catalog entry is one of four inputs, and for an exposed asset with total-control impact it starts a three day clock and a forensic triage. So the question an operator should ask about this week's six is not "are we patched", which is the right answer to the advisory, but "the morning one of these is added to KEV, does our clock start by itself, with the case open and the evidence collected, or does it start when someone reads the email".

What BOD 26-04 Actually Directs

CISA Binding Operational Directive 26-04, issued June 10, 2026, replaced BOD 22-01 and BOD 19-02. Under 22-01 the rule was simple: a CVE lands in the Known Exploited Vulnerabilities catalog, a due date comes with it, every agency patches by that date. 26-04 keeps KEV as an input and adds three more. For each vulnerable asset the agency now answers four questions:

• Asset exposure: is the vulnerable asset publicly exposed?
• KEV status: is the CVE on the KEV catalog?
• Exploit automation: can an adversary automate every step needed to exploit it?
• Technical impact: does exploitation give partial control or total control of the asset?

The sixteen combinations map to a deadline in Table 1: three days, fourteen days, sixty days, or fix on the next system upgrade. The clock starts at the earlier of CISA adding the CVE to KEV or the agency finding it on an asset. Three rows are marked "and forensic triage": a KEV-listed vulnerability with total control impact, on an exposed asset whether or not exploitation is automatable, or on a non-exposed asset where it is. For those, the agency must remediate within three days and complete a forensic triage of the asset to decide whether it was already compromised, and keep the record.

Phase I was effective on issuance. Phase II, the process changes, came due at 60 days. Phase III, remediation inside the Table 1 timelines, is due at 180 days, early December 2026. FedRAMP has told cloud providers to adopt the aligned vulnerability rules by December 7, 2026. The directive binds Federal Civilian Executive Branch agencies; CISA recommends the same model to state, local, tribal and territorial governments and to the private sector, and the utilities and hospitals we work with are treating it as the baseline their auditors will reach for next.

Why a Feed Is Not Enough Any More

A feed tells you a CVE exists and, when it reaches KEV, that someone is exploiting it. Everything after that is inventory, exposure, impact and forensics, on a three day clock, with a record at the end. For this week's six that means knowing which switches speak SNMP to what, which archive accepts DICOM from where, and which cameras are on a network segment that also carries something you care about, before the catalog moves. That is the pipeline we built.

The Automated Reaction, Step by Step

1. The catalog lands in your data. Caver ingests the CISA KEV catalog on every deployment, automatically, into a system index that any search can join against. CISA's Vulnrichment SSVC data arrives the same way and supplies the two variables KEV does not carry, exploit automation and technical impact. Where SSVC is absent for a CVE, the engine says so instead of guessing: "not automatable" is never confused with "not yet known".

2. Exposure comes from your telemetry, not a spreadsheet. Asset exposure, the directive's first variable, is derived from the feeds the implementation guidance names: external scanning, edge and firewall logs, DNS and certificate transparency, and the asset inventory the lake already holds. An asset that is reachable from the internet is graded exposed because the evidence says so.

3. Every asset and CVE pair gets its Table 1 row. The Vulnerability Center shows each finding with its matched row, its deadline, and a grade: on anchor, reset by a catalog change, or at risk. Next to it sits detectability: whether a detection ships for that CVE, what data it reads, and whether this lake is collecting that data. A finding you cannot see is flagged as such on the list, not discovered during the incident.

4. The three triage rows open a case by themselves. When a pair lands on row 1, 3 or 9, Caver opens a forensic triage case with the directive's phase clock already running: scoping complete at two hours, collection from two to twenty four hours, containment between six and twenty four, analysis by forty eight, escalation decision by seventy two. The BOD 26-04 forensic triage playbook attaches on creation: notify the case owner, collect the triage pack volatile data first, preserve non-volatile evidence once the volatile collection is complete.

Where Carbide Comes In

The collection step is a signed instruction to the Carbide agent on the affected host. Two rules from the CISA guidance are enforced in the agent, not in a runbook: collect the most volatile data first, and scope the collection to the alert and no wider. Items leave in acquisition order after RFC 3227: process and host memory, then the live state the operating system reports, process list, network connections, logged-on users, then registry keys, then files and event logs. Collection alters nothing on the host, is rate limited because a burst of memory acquisitions is its own signal, and is capped per instruction so "scoped to the alert" means a number.

When the triage says the asset is compromised, the same channel carries the response verbs: kill the process by its stable identity rather than a reused PID, isolate the host with a network lockdown that keeps the agent's own channel open, quarantine the file into custody with its hash taken on the way in. The forensic record exists before the first remediation action lands, which is the order the directive requires.

The Evidence Locker Is the Record

Everything the triage collects is deposited into the Caver Evidence Locker under the case. The locker is built for the part of BOD 26-04 that outlives the three days:

• Legal hold that reaches the lake. A case under hold registers a hold on the underlying data, so routine retention cannot age out the logs the triage relied on. Releasing the hold is a recorded action, not a side effect.
• Retention by class. Telemetry classes carry their own windows: short for high-volume flow data, years for the small event classes an investigation or a records request comes back for. Evidence under a case is governed by the case, not by the class it came from.
• Deletion that cannot be quiet. Deletes go through a queue; the approver cannot be the requester; a case under legal hold blocks deletion outright; a sealed case needs an explicit confirmation. Every action lands in the custody trail.
• A verifiable bundle. The export is signed and hash chained, so the forensic triage record CISA asks for is a package a third party can verify, not a screenshot of a dashboard.

What This Changes for You

If you are an FCEB agency, Phase III is weeks away and the forensic triage rows are the ones your inspector general will sample. If you are a utility, a hospital, a county or a contractor, the directive is guidance today and the audit standard tomorrow, and the three day rows are already the pace of exploitation: this quarter's WordPress, Roundcube and Citrix campaigns all began the same day their fixes shipped. Either way the question is the same: when the next KEV entry lands, does your clock start on its own, with the case open, the evidence collected and the record sealed, or does it start when someone reads the email.

For this week's six, the work before the catalog moves is the vendor fix where one exists: Malcolm 26.09.0, Eclipse Milo 1.1.5, N-Tron 700 firmware 3.11.1 with SNMP communities set or disabled and the web GUI off, dcm4chee-arc-light 5.35.2 with the DICOM and HL7 listeners restricted to registered peers, Torrent Suite 5.22. EseeCloud cameras have no fix and no vendor response, so the only control is the network they sit on. Caver ships content for the telemetry those controls produce: the OPC UA pack for Milo-based servers, the SNMP pack for the switches, Zeek with the ICS parsers for the segment traffic, and the clinical packs that read HL7 and FHIR flows around the archive.

RedEye threat intelligence is the front of that pipeline and it is free. Caver and Carbide are the rest of it.