CISA Advisory ICSA-26-288-01 Details Critical OPC UA Flaws in Eclipse Milo Enabling Industrial Method Execution Bypasses

The Cybersecurity and Infrastructure Security Agency (CISA) has issued industrial security advisory ICSA-26-288-01, alerting critical infrastructure operators to severe vulnerabilities affecting the Eclipse Foundation Eclipse Milo stack. Eclipse Milo is the primary open-source Java implementation of OPC Unified Architecture (OPC UA), deployed extensively across manufacturing execution systems (MES), SCADA front-ends, and energy distribution gateways.

Root Cause: Batch Call Authorization Desynchronization (CVE-2026-62927)

OPC UA Part 4 specifies the Call service, which enables client applications to request execution of methods on address-space nodes (such as starting a pump, resetting a turbine interlock, or modifying batch recipe setpoints). In Eclipse Milo versions 1.0.0 through 1.1.4, an authorization desynchronization weakness (CWE-863) exists within the request dispatch logic.

When an incoming CallRequest contains a batch of multiple method invocations, Milo evaluates client authorization against each node. However, when dispatching the resulting batch to underlying node handlers, the server code dispatches the original, unpruned request array. Consequently, an unauthenticated or read-only operator client can successfully execute an unauthorized industrial method simply by combining it within a batch request alongside an allowed method:

// Vulnerable dispatch pattern in Call service handler
CallResponse onCall(CallRequest request, SecuritySession session) {
    List<CallMethodResult> results = new ArrayList<>();
    for (CallMethodRequest req : request.getMethodsToCall()) {
        if (!accessController.canCall(session, req.getMethodId())) {
            results.add(new CallMethodResult(StatusCodes.Bad_UserAccessDenied));
        }
    }
    // VULNERABILITY: Dispatches original raw batch to lower-level address space!
    return addressSpace.invokeBatch(request.getMethodsToCall(), results);
}

Denial of Service via Direct Memory Leakage (CVE-2026-63252)

A second vulnerability, CVE-2026-63252 (CVSS 7.5), impacts OPC UA Secure Conversation (UASC) transport handlers across Milo versions 0.6.0 through 1.1.4. When incoming message chunks are received across a TCP connection that terminates unexpectedly before the final chunk arrives, the Netty buffer allocator fails to release the retained pooled direct byte buffers. An attacker sending high rates of truncated OPC UA handshakes can rapidly exhaust off-heap JVM memory, crashing the SCADA communication gateway.

Affected Versions & Remediation Matrix

IEC 62443 Defense-in-Depth Hardening Checklist

Asset owners in pharmaceutical, water, energy, and automotive sectors should implement the following compensating controls:

• Zone & Conduit Boundary Enforcement (IEC 62443-3-2): Restrict OPC UA port 4840/TCP ingress strictly to authorized Human-Machine Interface (HMI) and Supervisory workstations within Purdue Model Level 2 and Level 3.
• Enforce OPC UA Security Profiles: Disable the None security policy (unencrypted, unauthenticated endpoints) across all production Milo server endpoints. Enforce Basic256Sha256 or Aes128_Sha256_RsaOaep with mutual X.509 certificate validation.
• Upgrade Gateway Dependencies: Update Maven/Gradle builds to pull Milo 1.1.5:

  <dependency>
      <groupId>org.eclipse.milo</groupId>
      <artifactId>sdk-server</artifactId>
      <version>1.1.5</version>
  </dependency>