- CISA lists six CVEs in Eclipse Milo versions up to 1.1.4. Possible outcomes include deleted data, stolen credentials and servers that stop responding.
- The Eclipse Foundation recommends Milo 1.1.5. No 0.6.x release carries fixes, so those users must migrate.
- Leaders should inventory where Milo runs, ask vendors, and assign an owner to any 0.6.x migration.
A security fix is only useful if your version can receive it. For some users of Eclipse Milo, that is the problem. CISA's October 15 advisory says the Eclipse Foundation has no fixed release for the 0.6.x line. Those users cannot patch. They have to migrate.
What CISA published
CISA's industrial control systems advisory ICSA-26-288-01 covers six vulnerabilities in Eclipse Milo. The advisory does not explain what Milo does. CISA files it among industrial control system products, so the exposure sits in operational environments, not only office IT.
CISA names three worst-case outcomes. An attacker could wipe data that should have been protected. An attacker could take user credentials and pose as a real user. Or an attacker could leave the server silent for every client that depends on it.
The advisory lists the affected sectors as chemical, critical manufacturing, energy, and water and wastewater. It credits Abhinav Agarwal with reporting the flaws to CISA.
What kind of flaws these are
The advisory names five weakness types. Each one points to a different way a server can fail.
Two are authorization failures: incorrect authorization (CWE-863) and missing authorization (CWE-862). The server does not properly check whether a caller is allowed to do what it asks. That would be consistent with the advisory's warning about protected data being deleted.
A third is observable response discrepancy (CWE-204). The server answers differently depending on what was guessed. An attacker can learn from those differences. That is how secrets can leak without a break-in.
The last two are memory and resource leaks (CWE-401 and CWE-772). The server fails to give back memory or resources it no longer needs. This kind of flaw typically lets resources run short over time, which could match the advisory's outcome of a server that stops answering clients.
One caveat. The advisory text available to us does not say which CVE maps to which weakness or impact. It also gives no severity scores. The links above are our reading, and not every flaw should be assumed equally serious.
The version trap
The affected versions fall into two ranges. CVE-2026-63252, CVE-2026-63248 and CVE-2026-60007 affect Milo from 0.6.0 through 1.1.4. CVE-2026-62927, CVE-2026-58080 and CVE-2026-61387 affect Milo from 1.0.0 through 1.1.4.
For anyone on 1.x, the answer is a normal upgrade to 1.1.5. For anyone on 0.6.x, the Eclipse Foundation says no 0.6.x release carries the fixes. The advisory says those users must migrate to 1.1.5 or later.
This case shows why the gap between versions matters. A patch deadline is not the real cost. The real cost is the distance between the version you run and the version that still gets fixes. A team with a wide gap finds out when an advisory arrives.
What to ask your team
Start with inventory. Does any system we run, or any product we buy, use Eclipse Milo? If so, which version? Vendors may ship it inside their products, so ask them directly.
Next, ask about the 0.6.x line. If any system is on it, a migration project needs an owner and a date. A routine patch window will not cover it.
Then ask about exposure. CISA's guidance is to keep control system devices off the internet, place control networks behind firewalls and isolate them from business networks. Where remote access is needed, CISA suggests VPNs, with the warning that VPNs can have flaws and are only as secure as the devices behind them.
Finally, ask who would notice if a server stopped answering all clients. For the sectors CISA names, that question matters as much as data theft.
A version you cannot patch is usually the bill for a migration that was never planned.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
