CVE-2026-62927: Eclipse Milo OPC UA Authorization Bypass

CVE-2026-62927 is an incorrect-authorization flaw in Eclipse Milo, an open-source OPC UA stack used to build SCADA and industrial-automation servers and clients: its Call service checks authorization against a batch of method-call requests but then forwards the original, unfiltered batch to the handlers, so a remote attacker with no credentials can smuggle an unauthorized method call alongside authorized ones and have it executed.

CVE-2026-62927 is an incorrect authorization vulnerability (CWE-863) in Eclipse Milo, a widely embedded open-source Java implementation of the OPC UA protocol that many SCADA, HMI, and historian products use to talk to industrial controllers. NVD's analyzed record states that in the affected versions, "the Call service dispatches the original mixed batch to address-space handlers after calculating authorization," which lets an attacker bypass method-level access control by batching an unauthorized call together with authorized ones (NVD).

NVD lists CVSS v3.1 base score 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — network-reachable, low complexity, no privileges or user interaction needed, with a high integrity impact (unauthorized method execution) and no direct confidentiality or availability impact — and CVSS v4.0 8.7 (high) (NVD).

The CISA ICS advisory for this and related Eclipse Milo issues (which also cover memory-exhaustion and missing-authorization flaws in the same code paths) confirms the affected range as Eclipse Milo 1.0.0 up to and including 1.1.4, and states the Eclipse Foundation's fix ships in version 1.1.5, which users should upgrade to (CISA ICS Advisory ICSA-26-288-01). The Eclipse Foundation's own security tracker and the upstream patch commit confirm the same fix (Eclipse GitLab security tracker, work item 178; Eclipse Milo patch commit).

Neither the CISA advisory nor NVD report known public exploitation of CVE-2026-62927. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00418 (35.0th percentile) as of 2026-10-21 (CISA KEV, FIRST EPSS).

Any product that embeds Eclipse Milo 1.0.0 through 1.1.4 as its OPC UA server or client library should upgrade to 1.1.5 or later; because Milo is a library rather than a standalone product, affected deployments depend on which downstream SCADA/ICS products bundle the vulnerable version.

• The Call service in Eclipse Milo calculates authorization for a batch of method-call requests but dispatches the original, unfiltered batch to address-space handlers, allowing authorization bypass via request batching. — NVD
• NVD status is Analyzed with CVSS v3.1 base score 7.5 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and CVSS v4.0 8.7; CWE-863. — NVD
• Affects Eclipse Milo versions 1.0.0 through 1.1.4; fixed in 1.1.5. — CISA ICS Advisory ICSA-26-288-01
• Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
• EPSS score is 0.00418 (35.0th percentile) as of 2026-10-21. — FIRST EPSS