CISA published advisory ICSA-26-211-10 on 30 July, covering libiec61850 from MZ Automation. Eight defects, one outcome. All of them are out-of-bounds reads, and all of them end with a process stopping rather than being taken over: every vector in the advisory records no confidentiality and no integrity impact, with availability rated high.
What is affected, and what is not on the nameplate
Every version below 1.6.2 is affected. The advisory identifies the software that way, by library and version, and names no product that ships it. CISA tags the item to the energy sector, records the deployment area as worldwide, and puts the vendor in Germany.
That is the awkward part of this one. Nobody procures libiec61850. It is an IEC 61850 implementation that ends up compiled into somebody else's protection relay, bay controller, protocol gateway or station computer, and the version of it is not printed on the front panel. An asset register that lists equipment by make, model and firmware does not answer the question this advisory raises.
The two ways in
Three of the eight sit in the GOOSE path, on the process bus. One turns on a timestamp field shorter than the parser expects, one is an off-by-one that walks the buffer position forward incorrectly, and one accepts an inner element whose declared length runs past the element enclosing it. All three are reached with a single crafted Layer 2 multicast frame on EtherType 0x88B8, which the advisory describes as unauthenticated, and each kills the subscriber process: CVE-2026-66720, CVE-2026-66369 and CVE-2026-66364.
The other five sit behind MMS on TCP port 102. Two are decoder errors reached over an established session, CVE-2026-63550 and CVE-2026-66349. CVE-2026-65421 is an unvalidated length on fixed-width boolean and integer fields, and CVE-2026-56758 is in the ACSE layer, parsing the calling AP title of a connection request. CVE-2026-66360 is the one worth reading twice: it sits in the ISO presentation layer, it fires before the MMS session is established, and a crafted connection attempt on port 102 is enough to reach it. It carries the highest scores in the document, 7.5 under CVSS v3.1 and 8.7 under v4.0, with no privileges required.
An over-read that terminates a process is an availability problem, and on a process bus availability is the entire job. A subscriber that has stopped is not misreading a trip or interlock signal; it is not receiving one. Whether that surfaces as a communications alarm, a fallback to hardwired logic, or nothing visible until the next event depends on how the bay was engineered, and the advisory does not go there.
The fix, and the distance to it
MZ Automation's remedy is version 1.6.2, which CISA records as the mitigation for all eight, alongside the agency's usual segmentation and remote-access guidance. The set was reported by the Central Power Research Institute. CISA records no known public exploitation of any of them at the time of publication, which is worth exactly as much as it usually is for a bug reachable with one malformed frame.
Version 1.6.2 exists, and that is the easy half. A library fix reaches a substation only after the equipment vendor rebuilds firmware around it, releases that firmware, and someone takes the bay out of service to load it. This advisory covers the first link in that chain and is silent on the rest. The number it hands you is the version of a component, not the state of anything in the yard.
Source
- cisa.gov/news-events/ics-advisories/icsa-26-211-10