CVE-2026-62927 is an incorrect-authorization flaw in Eclipse Milo, an open-source OPC UA stack used to build SCADA and industrial-automation servers and clients: its Call service checks authorization against a batch of method-call requests but then forwards the original, unfiltered batch to the handlers, so a remote attacker with no credentials can smuggle an unauthorized method call alongside authorized ones and have it executed.
Vulnerability summary
CVSS base score
7.5
High severity
EPSS score (FIRST)
0.4%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-62927 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Eclipse Milo | cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:* | 1.0.0 through 1.1.4 (fixed in 1.1.5) |
What does this mean for affected devices?
CVE-2026-62927 is an incorrect authorization vulnerability (CWE-863) in Eclipse Milo, a widely embedded open-source Java implementation of the OPC UA protocol that many SCADA, HMI, and historian products use to talk to industrial controllers. NVD's analyzed record states that in the affected versions, "the Call service dispatches the original mixed batch to address-space handlers after calculating authorization," which lets an attacker bypass method-level access control by batching an unauthorized call together with authorized ones (NVD).
NVD lists CVSS v3.1 base score 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — network-reachable, low complexity, no privileges or user interaction needed, with a high integrity impact (unauthorized method execution) and no direct confidentiality or availability impact — and CVSS v4.0 8.7 (high) (NVD).
The CISA ICS advisory for this and related Eclipse Milo issues (which also cover memory-exhaustion and missing-authorization flaws in the same code paths) confirms the affected range as Eclipse Milo 1.0.0 up to and including 1.1.4, and states the Eclipse Foundation's fix ships in version 1.1.5, which users should upgrade to (CISA ICS Advisory ICSA-26-288-01). The Eclipse Foundation's own security tracker and the upstream patch commit confirm the same fix (Eclipse GitLab security tracker, work item 178; Eclipse Milo patch commit).
Neither the CISA advisory nor NVD report known public exploitation of CVE-2026-62927. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00418 (35.0th percentile) as of 2026-10-21 (CISA KEV, FIRST EPSS).
Any product that embeds Eclipse Milo 1.0.0 through 1.1.4 as its OPC UA server or client library should upgrade to 1.1.5 or later; because Milo is a library rather than a standalone product, affected deployments depend on which downstream SCADA/ICS products bundle the vulnerable version.
Evidence
- The Call service in Eclipse Milo calculates authorization for a batch of method-call requests but dispatches the original, unfiltered batch to address-space handlers, allowing authorization bypass via request batching. — NVD
- NVD status is Analyzed with CVSS v3.1 base score 7.5 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and CVSS v4.0 8.7; CWE-863. — NVD
- Affects Eclipse Milo versions 1.0.0 through 1.1.4; fixed in 1.1.5. — CISA ICS Advisory ICSA-26-288-01
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.00418 (35.0th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
How does an attacker exploit the Eclipse Milo authorization bypass without credentials?
By mixing an unauthorized method call into a batch of OPC UA Call requests alongside calls it is authorized to make: Milo's Call service checks authorization against the whole batch but then dispatches the original, unfiltered batch to the address-space handlers, so the unauthorized call executes anyway (per NVD).
Is CVE-2026-62927 known to be exploited in the wild?
No. Neither CISA nor NVD report observed exploitation, the CVE is absent from the CISA KEV catalog as of 2026-10-22, and FIRST's EPSS score is only 0.00418 (35th percentile) as of 2026-10-21 — low relative to the broader EPSS population (per CISA KEV; per FIRST EPSS).
Why does the fix matter differently depending on which product you use?
Eclipse Milo is a library, not a standalone product — it is embedded inside many SCADA and ICS integration products as their OPC UA stack, so whether a specific deployment is affected depends on which downstream vendor product bundles Milo 1.0.0 through 1.1.4; the fix (1.1.5) has to reach users through each vendor's own update path (per CISA ICS Advisory ICSA-26-288-01).
How severe is this vulnerability rated?
NVD's CVSS v3.1 base score is 7.5 (high), reflecting network-reachable, low-complexity, no-privilege access with a high integrity impact (the unauthorized method execution) but no direct confidentiality or availability loss; NVD's CVSS v4.0 score is higher at 8.7 (per NVD).
Questions about this page?