Johnson Controls Simplex Incident Manager

CISA ICS advisories published August 13–20, 2026, covering vulnerabilities in Johnson Controls Simplex Incident Manager and Metasys, Siemens Simcenter Nastran, Parasolid, and LOGO! Soft Comfort, AVEVA Enterprise SCADA, and CISA Malcolm. Issues include credential exposure in memory, stack overflow and out-of-bounds read vulnerabilities, cryptographic weaknesses, unsafe deserialization, persistent cross-site scripting, path traversal, unrestricted uploads, authorization flaws, and denial-of-service conditions. Several vulnerabilities can enable arbitrary code execution, session hijacking, data—,