ICS Advisories: Swiss OT Patch Triage 2026

On 30 June, CISA published a cluster of industrial-control advisories covering engineering software, SCADA/HMI software, data-centre management, RTU firmware and industrial terminals. This is not proof that any affected product is deployed in Switzerland, nor does it establish a common campaign. It is nevertheless a useful prompt for Swiss OT teams: several findings sit in the systems that bridge engineering workstations, supervisory applications and operational facilities, where ordinary IT patch logic can create unacceptable process risk. The right question is not which CVSS score looks most alarming in isolation. It is which documented asset, exposure path and maintenance window turn an advisory into a credible operational risk.

Read the batch as an asset-mapping problem

The five CISA notices describe different preconditions. Mitsubishi MELSOFT Update Manager versions 1.000A through 1.014Q include vulnerable 7-Zip components. CISA describes a local archive-processing issue and identifies version 1.015R or later as the remediation path. That matters primarily where an engineer or support process can be induced to handle a crafted archive. It is not an internet-facing controller vulnerability, but it can matter on an engineering workstation that holds project files, credentials or trusted update tooling. The vendor advisory is catalogued at https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01.

FUXA SCADA/HMI through 1.3.1 has CVE-2026-13207, a path-normalisation authentication-bypass issue rated CVSS 7.5, with version 1.3.2 or later identified as the fix. FUXA is a Swiss-headquartered vendor, which may make the notice particularly visible to local integrators, but its headquarters do not indicate where customers run the product. The first triage task is to locate every FUXA instance, its version, its exposed routes and the identity boundary in front of it. CISA's record is https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02.

The remaining notices are similarly specific. EcoStruxure IT Data Center Expert through 9.1.1 has an authenticated XML external entity issue fixed in 9.1.2. Schneider Electric RTU issues CVE-2026-9650 and CVE-2026-9651 are addressed by T150 firmware 11.06.32 and Saitel firmware 11.06.38. B&R terminal advisory coverage includes the XZ Utils issue CVE-2025-31115, rated CVSS 7.5. The primary records are https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-03, https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-04 and https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-05.

Prioritise reachable trust boundaries, not product names

A patch queue built only from vendor names creates blind spots. FUXA deserves rapid assessment if its web interface is reachable from an enterprise network, a remote-access zone or an integrator connection. The same finding may be materially less urgent on an isolated, access-controlled HMI with no route from user networks, while still requiring a scheduled fix. Conversely, an authenticated XXE issue in data-centre management can be important when broad administrator groups, automation accounts or a compromised jump host can reach the service. Authentication is a precondition, not a safety guarantee.

Firmware findings require a different decision path. An RTU update can affect communications, connected I/O or a validated process configuration. A maintenance plan should identify the exact hardware, bootloader and current firmware, obtain the vendor-supported package, establish rollback conditions and coordinate with operations. The objective is not to preserve a theoretical perfect patch cadence. It is to reduce a known exposure without introducing an avoidable safety, availability or quality event. That principle applies to regulated manufacturing and utilities, but also to hospitals and medtech estates when building-management, laboratory or facilities systems share operational dependencies. These are governance examples, not claims about affected Swiss deployments.

Make the exception process operational

OT patch triage fails when a deferred update becomes an unrecorded assumption. Every deferral should name an accountable system owner, the reason a patch cannot proceed, the exposure that remains, the compensating control, a review date and an escalation route. Network segmentation, a tightly managed jump host, MFA for remote administration, application allowlisting and monitoring of management-plane access can reduce exposure, but none changes the affected version. They buy time only when their operation can be demonstrated.

Swiss organisations subject to the federal reporting duty should also rehearse how a suspected compromise would be assessed and escalated. The NCSC's current guidance on mandatory reporting is at https://www.ncsc.admin.ch/ncsc/en/home/meldepflicht.html. The practical value is not in treating each advisory as a reportable incident. It is in keeping OT, cyber, legal and executive contacts ready so that an exploitation signal can be evaluated without reconstructing decision rights during an outage.

Actions for Swiss OT and security teams

• Reconcile the advisories against the OT asset inventory. Record product, version, physical site, owner, network zone and support status rather than relying on procurement records.
• Test reachability from realistic attacker positions. Include enterprise user networks, remote-access paths, vendor connections and privileged jump hosts in the assessment.
• Upgrade MELSOFT Update Manager to 1.015R or later. Until then, restrict archive handling to controlled engineering workflows and inspect the workstation's local privileges.
• Move FUXA deployments to 1.3.2 or later after validation. Remove unnecessary exposure, review reverse proxies and confirm that authentication controls cannot be bypassed at alternate paths.
• Schedule supported Schneider and B&R remediation. Verify the precise Data Center Expert, RTU and terminal models before applying version 9.1.2, T150 11.06.32 or Saitel 11.06.38 as applicable.
• Document every OT patch exception. Tie it to compensating controls, a named risk owner, a next review date and a tested recovery plan.
• Exercise incident escalation around an operational constraint. Validate that teams can collect evidence and meet NCSC reporting obligations without compromising safe plant operation.

The durable outcome from this batch should be a better repeatable triage method. As OT environments acquire more web interfaces, update utilities and central management services, the meaningful distinction will be between teams that can prove what they run and teams that only recognise products after an advisory arrives. A maintained inventory, clear ownership and rehearsed safe-change practice turn the next notice from a disruptive search into a bounded engineering decision.