Security researchers from Cisco Talos identified eight (8) vulnerabilities affecting the Open Automation Software (OAS) platform, with two (2) of them being deemed critical. OAS is a very popular one-stop-shop data connectivity solution designed to facilitate simplified data transfers between many different proprietary devices like “industrial devices (PLCs, OPCs, Modbus), SCADA systems, IoTs, network points, custom applications, custom APIs, and databases…” The most severe critical vulnerability (CVSS 9.4), tracked as CVE-2022-26833, is an improper authentication vulnerability within the REST API function of OAS that can be exploited by sending maliciously crafted HTTP packet requests, giving the attacker full access to the REST API. The second critical flaw (CVSS 9.1), tracked as CVE-2022-26082, is described as a file write vulnerability within the Engine SecureTransferFiles functionality of OAS, that can be similarly exploited by sending a series of malicious HTTP requests, ultimately leading to remote code execution (RCE). The rest of the identified vulnerabilities are still considered high severity, albeit not critical, and the details can be found in the Cisco Talos Vulnerability Spotlight linked below. Industrial environments are notoriously difficult to upgrade in a timely manner, given that they handle highly complex data connectivity systems that govern critical processes in both business and national infrastructure. Restarting systems to install upgrades will cause unavoidable negative impacts that administrators will have to mitigate and establish contingencies for, but the negative impacts of threat actors successfully exploiting these very high-severity vulnerabilities greatly outweigh the potential operational loss. These flaws have been officially patched, and the CTIX team recommends any OAS administrators upgrade immediately. Talos has worked alongside OAS to identify manual mitigations to these flaws, and if processes simply cannot be stopped all at once, administrators should consider using the manual techniques to fill in the gaps in processes, while systematically compartmentalizing and upgrading their vulnerable infrastructure.