Eclipse Foundation Eclipse Milo

1. Executive summary

The Eclipse Foundation has published fixes for six vulnerabilities in Eclipse Milo, the Java OPC UA stack used to build both clients and servers. Milo 1.1.5 is the only release carrying the fixes; the 0.6.x line has no patched build and must migrate to 1.1.5 or later. The most severe is CVE-2026-60007 (CVSS 9.1 CRITICAL, CWE-204), a padding-oracle flaw in username-token processing that lets an on-path attacker recover a victim's password and authenticate with it. None of the six CVEs is in CISA KEV and EPSS sits at 0% to 1% across the set, so there is no evidence of exploitation in the wild, but the affected component is an OPC UA server library and the exposure is real wherever Milo endpoints are reachable. EMEA financial services exposure is indirect: Milo is not a core banking component, but it appears in industrial telemetry, building management, and lab or test environments that bridge into corporate networks.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item. The vulnerabilities are not known to be exploited, and no incident has occurred.

3. Technical analysis & attack chain

This is a vendor patch advisory covering six CVEs in one product. The verified reference data and the CISA advisory agree on the CWE classification for all six, with one exception noted below. No exploitation in the wild is recorded for any of them.

Prioritised triage

CVE-2026-60007: padding oracle in username-token processing

Milo versions 0.6.0 through 1.1.4 return distinguishable errors when an RSA PKCS#1 v1.5 decryption fails on padding versus when it fails for another authentication reason. An attacker positioned on the path between client and server captures a victim's Basic128Rsa15-encrypted username token, then sends repeated unauthenticated ActivateSession requests and reads the error responses as a padding oracle. Each request narrows the candidate plaintext. The recovered value is the victim's password, which the attacker then uses to authenticate as that user.

The precondition is on-path access to OPC UA traffic encrypted with Basic128Rsa15. Basic128Rsa15 is a legacy security policy; where it is still configured, the attacker does not need to break the encryption, only to observe the ciphertext and query the server. The verified reference data records CWE-204 (Observable Response Discrepancy) for this CVE. The CISA advisory text describes the same flaw as a padding oracle, which is the exploitation technique rather than the weakness class; both descriptions apply to the same defect.

CVE-2026-58080: RoleMapper lost through config copy

OpcUaServerConfig.copy() does not carry a configured RoleMapper into the copied configuration. Servers that build their running configuration by calling copy() therefore start with no role mapping. Sessions receive no role IDs, and the default access controller skips role-permission checks when a session has no roles. On a server that permits anonymous sessions, an anonymous client can read role-permission metadata, invoke methods that role permissions were meant to protect, and delete protected nodes. The flaw is conditional on the deployment pattern: a server that does not call copy(), or that does not permit anonymous sessions, is not exposed through this path.

CVE-2026-62927: authorization calculated before batch dispatch

The Call service calculates authorization against the batch, then dispatches the original mixed batch to address-space handlers. A client that batches a denied method together with an allowed method gets the denied method executed. The attacker needs only a low-privileged or anonymous session. This is the classic time-of-check to time-of-use gap between the authorization decision and the dispatch, and it defeats method-level access control wherever the server relies on it.

CVE-2026-63252: direct-memory exhaustion through retained chunks

UASC server transport handlers do not release retained partial message chunks when a channel disconnects. A remote unauthenticated client sends incomplete chunks and disconnects, repeatedly. Each cycle retains memory from the pooled direct allocator. Sustained repetition exhausts the pool and can terminate the server. No credentials are needed and the traffic is ordinary OPC UA transport, so the attack does not stand out at the protocol level.

CVE-2026-63248: diagnostics nodes without authorization

OPC UA server diagnostics nodes do not enforce access authorization. Over a None/None endpoint, an anonymous client with no certificate can enable diagnostics. Over SignAndEncrypt with a trusted client application certificate, the client can read security diagnostics for other active sessions. The exposed fields are usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. The second path is the more useful one for an attacker: a trusted certificate is often obtainable through a legitimate integration, and the diagnostics data maps the user population and the authentication configuration of the server.

CVE-2026-61387: monitored-item quota exhaustion

Monitored-item quota accounting is not exception-safe. When item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter trigger a StackOverflowError during decoding, which is the unchecked error that leaks the reservation. An unauthenticated remote client repeats this until the finite global quota is exhausted, after which no client can create new monitored items until the server restarts. Existing monitored items and other server functions keep working, so the failure is partial and may not be noticed immediately.

Discrepancy note

The CISA advisory's summary table lists a CVSS v3 score of 8.2 for the product. The verified reference data gives per-CVE scores of 9.1, 8.8, 8.7, 8.7, 6.9 and 6.9. The 8.2 figure is a product-level aggregate and does not correspond to any single CVE in the set; use the per-CVE values above.

Attribution

No threat actor is named in the CISA advisory or in the verified reference data. The vulnerabilities were reported to CISA by Abhinav Agarwal. There is no MITRE ATT&CK profile associated with this item and no attribution to any group. Any claim of actor involvement would be unsupported.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every deployment of Eclipse Milo. Check the dependency manifest, the application server classpath, and any shaded or fat JAR that bundles org.eclipse.milo classes. The affected ranges are 0.6.0 through 1.1.4 for CVE-2026-63252, CVE-2026-63248 and CVE-2026-60007, and 1.0.0 through 1.1.4 for CVE-2026-62927, CVE-2026-58080 and CVE-2026-61387.
• Where a Milo OPC UA server is reachable from outside its control network, block inbound access at the perimeter. CISA's recommended practice is to keep control system devices off the internet and behind a firewall isolated from business networks.
• Disable anonymous sessions on every Milo server that permits them. This removes the anonymous path for CVE-2026-58080 and CVE-2026-63248 and raises the bar for CVE-2026-62927.
• Stop using the Basic128Rsa15 security policy. CVE-2026-60007 depends on capturing a Basic128Rsa15-encrypted username token; moving to a current policy removes the precondition. Treat any password that has traversed a Basic128Rsa15 session as compromised and rotate it.

P2 (within 72 hours)

• Upgrade to Eclipse Milo 1.1.5 (https://github.com/eclipse-milo/milo/releases/tag/v1.1.5). This is the vendor fix for all six CVEs.
• For deployments on the 0.6.x line, there is no patched 0.6.x release. Plan the migration to 1.1.5 or later. Until the migration completes, apply the P1 controls and treat the 0.6.x endpoints as unpatchable.
• Audit server code for calls to OpcUaServerConfig.copy() that are expected to carry a RoleMapper. If the running configuration is built through copy(), verify after the upgrade that role IDs are present on sessions and that role-permission checks are enforced. The upgrade fixes the copy behaviour, but a deployment that compensated for the bug in application code may need that compensation removed.
• Review method-level access control on any server that exposes the Call service to low-privileged clients, given CVE-2026-62927.

P3 (within 7 days)

• Set a monitored-item quota alert. CVE-2026-61387 exhausts the global quota without affecting existing items, so the first symptom is failed item creation across all clients. Alert on a sustained rise in CreateMonitoredItems failures and on quota utilisation approaching the configured limit.
• Monitor pooled direct memory on Milo servers. CVE-2026-63252 shows up as growth in the direct buffer pool that does not fall after client disconnects.
• Restrict access to OPC UA diagnostics nodes to named administrative sessions, and review who holds trusted client application certificates, since CVE-2026-63248 exposes session security diagnostics to any trusted certificate holder.
• Where remote access to OPC UA endpoints is required, use a VPN and keep the VPN and the connected devices current, per CISA's recommended practices.

5. Indicators of compromise

No indicators of compromise available in the source material. The CISA advisory and the verified reference data contain no hashes, domains, IP addresses, file paths, or command lines. This is a vulnerability disclosure, not an incident report.

The behaviours below are the observable effects of the flaws. They are not atomic indicators and are not machine-pivotable on their own.

Behavioural indicators

6. Detection

The sources give no file artefacts, command lines, mutexes, or registry keys. The distinctive material is in the OPC UA protocol behaviour, which is best expressed as a Sigma rule over server logs rather than a YARA rule over files. No YARA rule is emitted: there is no malicious file to match.

title: Eclipse Milo OPC UA Exploitation Attempts
id: 7f3c1a92-4b6e-4d21-9c8a-2e5f0b7a1d34
status: experimental
description: Detects OPC UA server log patterns consistent with the Eclipse Milo vulnerabilities fixed in 1.1.5 (CVE-2026-60007, CVE-2026-58080, CVE-2026-62927, CVE-2026-63252, CVE-2026-63248, CVE-2026-61387).
author: Adverse Trace
date: 2026-10-15
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01
logsource:
  product: opcua
  service: server
detection:
  padding_oracle:
    message|contains:

      - 'ActivateSession'
      - 'BadSecurityChecksFailed'
  anonymous_diagnostics:
    message|contains:

      - 'None/None'
      - 'diagnostics'
  quota_exhaustion:
    message|contains:

      - 'CreateMonitoredItems'
      - 'StackOverflowError'
  memory_exhaustion:
    message|contains:

      - 'OutOfMemoryError'
      - 'direct buffer'
  condition: padding_oracle or anonymous_diagnostics or quota_exhaustion or memory_exhaustion
falsepositives:

  - Legitimate diagnostics access by administrative sessions
  - Client reconnection storms producing repeated ActivateSession entries
level: medium

The rule matches on log strings that the Milo server emits for the affected code paths. Tune the falsepositives entries against the deployment before enabling alerting.

CVE assessment

6 referenced CVEs — 1 critical (CVSS ≥ 9.0)

7. Sources

• CISA, "Eclipse Foundation Eclipse Milo", ICSA-26-288-01, 2026-10-15. https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01
• Eclipse Foundation, "Eclipse Milo v1.1.5 release", 2026. https://github.com/eclipse-milo/milo/releases/tag/v1.1.5

8. Adverse Trace position

Adverse Trace assesses this as a patch-now item with no evidence of active exploitation. The verified reference data places all six CVEs outside CISA KEV with EPSS between 0% and 1%, so the near-term likelihood of exploitation against a given client is low, but CVE-2026-60007 at CVSS 9.1 is a credential-recovery flaw and CVE-2026-58080 at 8.8 is an authorization bypass, and both become serious the moment a Milo endpoint is reachable from an untrusted network. The 0.6.x branch has no fix, which turns a routine upgrade into a migration for any client still on it. Client impact is concentrated in industrial, building-management, and test environments rather than core banking, but those environments frequently sit on the same network as production systems. We will track whether any of the six CVEs is added to CISA KEV, and we will reissue this advisory if exploitation is reported or if the Eclipse Foundation publishes a 0.6.x backport. Clients who need help locating Milo in shaded JARs or planning the 0.6.x migration should contact their Adverse Trace account team.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.