October 2025 Enterprise Software and ICS Security Advisories and Patch Releases
Major enterprise software vendors and industrial control system (ICS) security authorities released coordinated security advisories and patches between October 6 and 14, 2025, addressing critical vulnerabilities across a wide range of products. IBM published multiple security advisories for its products, urging users and administrators to review the details and apply necessary updates to mitigate potential exploitation risks. Dell issued a security advisory for its SupportAssist software for both Home and Business PCs, highlighting a vulnerability in versions prior to 4.8.2.29006 and 4.5.3.25254, respectively, and recommending immediate updates. Red Hat released advisories for vulnerabilities in the Linux kernel affecting several of its enterprise products, including Red Hat CodeReady Linux Builder, Red Hat Enterprise Linux, and Red Hat Enterprise Linux for Real Time, across multiple versions and platforms. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published ICS advisories for vulnerabilities in products from Delta Electronics, Hitachi Energy, and Rockwell Automation, with specific attention to various versions of DIAScreen, Asset Suite, and multiple Rockwell Automation network and firewall solutions, recommending mitigations and updates where available. SAP released its October 2025 monthly security rollup, which included patches for a broad set of products such as SAP NetWeaver AS Java, SAP Print Service, SAP Supplier Relationship Management, SAP Commerce Cloud, SAP Data Hub Integration Suite, SAP Application Server for ABAP, SAP S/4HANA, SAP Financial Service Claims Management, SAP BusinessObjects, and SAP Cloud Appliance Library Appliances. The SAP advisories specifically addressed vulnerabilities in NetWeaver, including unauthenticated remote code execution (RCE) risks, and provided detailed guidance for affected versions. Security researchers highlighted the criticality of the SAP NetWeaver flaw, emphasizing the unauthenticated RCE risk and the urgent need for patching to prevent potential exploitation. The coordinated release of these advisories underscores the ongoing threat landscape facing enterprise and ICS environments, where timely patching and mitigation are essential to maintaining security. Organizations are strongly encouraged to review all relevant advisories, assess their exposure, and implement recommended updates and mitigations without delay. The advisories reflect a broad spectrum of vulnerabilities, from privilege escalation and RCE to authentication bypass and information disclosure, affecting both IT and OT environments. The inclusion of ICS products in the advisories highlights the convergence of IT and OT security concerns and the need for cross-domain vigilance. The security community and government agencies continue to collaborate in disseminating timely information to help organizations defend against emerging threats. The October 2025 patch cycle demonstrates the complexity and interdependence of modern enterprise and industrial systems, where vulnerabilities in widely deployed products can have far-reaching consequences. Proactive vulnerability management, including regular review of vendor advisories and prompt application of patches, remains a cornerstone of effective cybersecurity strategy. Failure to address these advisories could leave organizations exposed to targeted attacks, ransomware, or disruption of critical business and industrial operations. The breadth of affected products and vendors in this cycle serves as a reminder of the persistent and evolving nature of cyber risk in the digital enterprise.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat publishes security advisory AV25-659
Red Hat released security advisory AV25-659 for one or more security issues affecting its products. The advisory was published on October 14, 2025.
CISA ICS advisories are issued in control systems bulletin AV25-660
A control systems bulletin referencing CISA ICS security advisories was published, indicating new or updated industrial control systems vulnerability notices. The bulletin was released on October 14, 2025.
IBM publishes security advisory AV25-656
IBM released security advisory AV25-656 covering one or more vulnerabilities in its products. The advisory was published on October 14, 2025.
Dell publishes security advisory AV25-657
Dell released security advisory AV25-657 addressing one or more product security issues. The reference indicates the advisory was publicly issued on October 14, 2025.
SAP releases October 2025 security rollup for NetWeaver flaw
SAP issued its October 2025 monthly security rollup, including a patch for a critical CVSS 10.0 vulnerability in NetWeaver that could allow unauthenticated remote code execution. Multiple references on the same date point to this coordinated vendor advisory and patch release.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
6 references tracked. Mallory keeps watching after this page renders.
IBM security advisory (AV25-656)
cyber.gc.ca
Open sourceSAP Patches Critical 10.0 Flaw in NetWeaver: Unauthenticated RCE Risk
securityonline.info
Open sourceDell security advisory (AV25-657)
cyber.gc.ca
Open sourceRed Hat security advisory (AV25-659)
cyber.gc.ca
Open source[Control systems] CISA ICS security advisories (AV25–660)
cyber.gc.ca
Open sourceSAP security advisory – October 2025 monthly rollup (AV25-662)
cyber.gc.ca
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Security Advisories for Enterprise and Industrial Products (Late October–Early November 2025)
Vendors including Hitachi Energy, Schneider Electric, ABB, Ubiquiti, Dell, IBM, Red Hat, Ubuntu, and Microsoft released security advisories between October 27 and November 3, 2025, addressing vulnerabilities across a wide range of enterprise, industrial, and cloud products. Notable advisories include CISA's ICS alerts for control systems, a critical flaw in ABB's PCM600 software (CVE-2018-1002208), a critical vulnerability in Ubiquiti's UniFi Access Application (CVE-2025-52665), and updates for Microsoft Edge, Red Hat Enterprise Linux, Ubuntu LTS versions, and multiple Dell and IBM products. Organizations are urged to review the advisories, apply recommended mitigations, and update affected systems to reduce exposure to exploitation. The advisories highlight vulnerabilities that could allow remote code execution, privilege escalation, or unauthorized access if left unpatched. The Canadian Centre for Cyber Security and CISA emphasize the importance of timely patching and mitigation, especially for products deployed in critical infrastructure and enterprise environments. Administrators should consult the official vendor advisories for detailed remediation steps and monitor for further updates as new vulnerabilities are disclosed and addressed.
Mar 21, 2026
CISA Releases Multiple Industrial Control Systems Vulnerability Advisories
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a series of advisories addressing newly discovered vulnerabilities in a wide range of industrial control systems (ICS) products. These advisories, released between October 13 and 21, 2025, cover products from major vendors such as Rockwell Automation, Siemens, Schneider Electric, Delta Electronics, Hitachi Energy, and Oxford Nanopore Technologies. The advisories provide technical details about the vulnerabilities, including affected versions, potential impacts, and recommended mitigations. For Rockwell Automation, advisories were published for products including the 1783-NATR, Compact GuardLogix 5370, 1715 EtherNet/IP, ArmorStart AOP, FactoryTalk Linx, FactoryTalk View Machine Edition, and PanelView Plus 7 Terminal, with some vulnerabilities identified by specific CVEs such as CVE-2025-9063 and CVE-2025-9064. Siemens products affected include SIMATIC S7-1200 CPU V1/V2 Devices, RUGGEDCOM ROS Devices, HyperLynx, Industrial Edge App Publisher, SIMATIC ET 200SP Communication Processors, SINEC NMS, SiPass Integrated, Solid Edge SE2024 and SE2025, and TeleControl Server Basic. Schneider Electric advisories addressed issues in Pro-Face GP-Pro EX and Remote HMI, Modicon Controllers, Advanced Reporting and Dashboards Module for EcoStruxure Power Operation, and EcoStruxure Power Monitoring Expert (PME) across several versions. Additional advisories were released for CloudEdge Online Cameras and App, Raisecomm RAX701-GC Series, and Oxford Nanopore Technologies MinKNOW. The advisories detail the nature of the vulnerabilities, which range from improper input validation to authentication bypass and remote code execution risks. CISA and the Canadian Centre for Cyber Security both urge ICS users and administrators to review the advisories, apply recommended mitigations, and update affected systems to reduce the risk of exploitation. The coordinated release of these advisories highlights the ongoing threat landscape facing critical infrastructure and the need for timely patch management. Many of the vulnerabilities could allow attackers to gain unauthorized access, disrupt operations, or compromise sensitive industrial processes. The advisories include links to technical documentation and vendor updates, enabling organizations to assess their exposure and take immediate action. The affected products are widely deployed in sectors such as manufacturing, energy, and utilities, increasing the urgency for remediation. CISA’s advisories are part of a broader effort to enhance the security posture of industrial environments against evolving cyber threats. The inclusion of both new and updated advisories for previously disclosed vulnerabilities demonstrates the dynamic nature of ICS security. Organizations are reminded to follow best practices for ICS security, including network segmentation, access control, and regular vulnerability assessments. The advisories also emphasize the importance of monitoring for signs of exploitation and maintaining up-to-date incident response plans. By addressing these vulnerabilities promptly, asset owners can help safeguard critical infrastructure from potential cyberattacks.
Mar 21, 2026
Multiple Security Advisories for Enterprise and Industrial Products
Several major vendors, including Dell, IBM, and CISA, have released security advisories addressing vulnerabilities in a wide range of enterprise and industrial control system products. Dell's advisories cover critical updates for products such as APEX Cloud Platform for Red Hat OpenShift, Enterprise SONiC Distribution, NetWorker, PowerSwitch models, and iDRAC controllers, urging administrators to apply patches to mitigate potential risks. IBM has similarly published advisories for multiple products, while CISA has issued alerts for vulnerabilities in industrial control systems from vendors like ABB, Advantech, Delta Electronics, Fuji Electric, IDIS, Radiometrics, Survision, and Ubia, recommending prompt mitigation and updates. In addition to these broad advisories, a critical denial-of-service vulnerability (CVE-2024-20399) was identified in Cisco's Identity Services Engine (ISE), which could allow unauthenticated attackers to crash network access control systems by exploiting the RADIUS protocol. Cisco has provided both temporary and permanent mitigation steps for affected versions. Separately, CISA added a Samsung Mobile Devices out-of-bounds write vulnerability (CVE-2025-21042) to its Known Exploited Vulnerabilities Catalog, highlighting the ongoing risk posed by actively exploited flaws and urging organizations to prioritize remediation to protect against cyber threats.
Mar 21, 2026