CVE-2026-60007: Eclipse Milo OPC UA Padding-Oracle Credential Theft

Checked: 2026-10-29

CVE-2026-60007 is a padding-oracle vulnerability in Eclipse Milo, an open-source Java SDK for the industrial OPC UA protocol, that lets an on-path attacker who intercepts an encrypted username/password login token use repeated login attempts to recover the victim's password and then log in as that user, affecting Milo 0.6.0 through 1.1.4 with no fix on the older 0.6.x branch.

Vulnerability summary

Vulnerability ID	CVE-2026-60007
CVSS score	7.4
EPSS score	0.00553
CISA KEV	No
Source	NVD
Published	2026-08-04T13:18:55.427

Affected components

Component	CPE	Version range
Eclipse Milo (OPC UA SDK)	cpe:2.3:a:eclipse:milo::::::::	0.6.0 through 1.1.4 (fixed in 1.1.5; no patched 0.6.x release exists — the 0.6.x branch must migrate to 1.1.5 or later)

What this means

CVE-2026-60007 is a CWE-204 (Observable Response Discrepancy) vulnerability in Eclipse Milo, an open-source Java implementation of the OPC UA (OPC Unified Architecture) protocol stack widely embedded in industrial SCADA/PLC communication software. NVD's description states: "In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials" (NVD).

NVD published its own Primary CVSS v3.1 score of 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N — network vector but high attack complexity, reflecting the on-path (MITM-style) positioning the attack requires. The Eclipse Foundation separately rates it CVSS v4.0 9.1 (critical), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, but that is the vendor's own score, not NVD's, so it is treated as not NVD-confirmed and not used as this page's cvss_score (Eclipse GitLab — CVE assignment work item 183).

CISA's ICS advisory groups CVE-2026-60007 with five other Milo CVEs (CVE-2026-62927, CVE-2026-63252, CVE-2026-58080, CVE-2026-63248, CVE-2026-61387) and states that, across the group, "successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients" — the "recover user credentials and impersonate legitimate users" outcome is the one that applies specifically to this padding-oracle CVE. The advisory also confirms the CWE-204 / CAPEC-463 (Padding Oracle Crypto Attack) classification and the remediation path: "The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5," adding that "for users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later" (CISA ICS Advisory ICSA-26-288-01).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.00553 (0.55%), 46th percentile — low, consistent with an attack that requires an on-path network position rather than a simple internet-facing exploit, and the CVE is not on CISA's KEV catalog, so there is no evidence of active exploitation beyond this theoretical padding-oracle path (FIRST EPSS).

Any deployment embedding Eclipse Milo for OPC UA communication — common in industrial automation gateways and SCADA middleware — should upgrade to 1.1.5 or later, and operators still on the 0.6.x branch must plan a version migration since no backport exists.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

Username-token processing in Eclipse Milo 0.6.0-1.1.4 returns distinguishable padding-validation errors, letting an on-path attacker use repeated ActivateSession requests as a padding oracle to recover a victim's password and authenticate as them. — NVD
NVD Primary CVSS v3.1 score is 7.4 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; the Eclipse Foundation's own CVSS v4.0 9.1 score is vendor-submitted, not NVD-confirmed. — NVD
Classified CWE-204 / CAPEC-463 Padding Oracle Crypto Attack; Eclipse Foundation CVE-assignment tracker confirms the vendor CVSS v4.0 9.1 rating and affected range 0.6.0-1.1.4. — Eclipse GitLab CVE-assignment work item 183
CISA ICS advisory groups this with five related Milo CVEs, states exploitation "could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients," and recommends upgrading to Milo 1.1.5 since no fixed 0.6.x release exists. — CISA ICS Advisory ICSA-26-288-01
EPSS score is 0.00553 (0.55%), 46th percentile, as of 2026-10-28; not listed on the CISA KEV catalog. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2025-62593: Ray AI Compute Engine Browser-to-RCE via DNS Rebinding (KEV)CVE-2025-62593: KEV code injection in Ray lets an attacker combine DNS rebinding with a Firefox/Safari User-Agent spoof to reach a developer's local Ray dashboard and run arbitrary code. Sourced to NVD, CISA and Ray-Project.