ICS Patch Tuesday: Vulnerabilities Addressed by Siemens, Rockwell, Aveva, Schneider

On 12 November 2025, SecurityWeek reports that industrial giants Siemens, Schneider Electric, Rockwell Automation and Aveva issued Patch Tuesday advisories covering a range of ICS/OT vulnerabilities. Siemens published six new advisories, including two in its Comos plant engineering software, one of which is a critical code execution flaw and another a high-severity security bypass issue.

Rockwell Automation released five advisories on 11 November detailing issues across Studio 5000, Verve Asset Manager OT platform, FactoryTalk DataMosaix Private Cloud, SIS Workstation and FactoryTalk Policy Manager.

Aveva published two advisories on the same Patch Tuesday, describing a high-severity persistent XSS flaw that can be exploited for privilege escalation and an Aveva Edge vulnerability that could let an attacker brute-force weak hashes to obtain passwords, with the latter also impacting Schneider Electric’s EcoStruxure Machine SCADA Expert and Pro-face BLUE Open Studio.

Schneider Electric published two advisories as well, including high-severity path traversal, authentication brute-forcing and privilege escalation issues in PowerChute Serial Shutdown UPS management software.