CVE-2026-63248 Eclipse CVE debrief

Who should care

Organizations utilizing Eclipse Milo versions 0.6.0 through 1.1.4 in their infrastructure should prioritize patching to mitigate the risk of unauthorized access to OPC UA server diagnostics nodes. This is crucial for preventing potential security breaches that could expose sensitive information. IT and security teams responsible for managing and securing OPC UA server environments are particularly advised to take immediate action. Additionally, operators and administrators of affected systems should review and implement the recommended actions to ensure the security of their environments. Vulnerability management and security teams should also be aware of the potential impact and take steps to verify and mitigate the vulnerability in their systems. Asset owners and security personnel must collaborate to ensure that all necessary steps are taken to protect against potential exploitation. This includes verifying the presence of affected systems, assessing the potential impact, and implementing compensating controls if necessary. By taking proactive measures, organizations can minimize the risk associated with this vulnerability and protect their critical assets. The urgency of this issue necessitates prompt attention and action from all relevant stakeholders to prevent potential security incidents. Security teams should also monitor OPC UA server diagnostics nodes for unauthorized access attempts and implement additional security measures to detect and respond to potential threats. By prioritizing patching and implementing recommended actions, organizations can effectively mitigate the risk associated with this vulnerability and maintain the security of their OPC UA server environments. It is essential for organizations to address this vulnerability in a timely manner to prevent potential security breaches and protect their critical assets. The implementation of compensating controls and monitoring of OPC UA server diagnostics nodes can also help to detect and respond to potential threats. Overall, a proactive and coordinated approach is necessary to address this vulnerability and ensure the security of OPC UA server environments. This includes collaboration among

Technical summary

Eclipse Milo versions 0.6.0 through 1.1.4 have a vulnerability where OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

Defensive priority

Organizations using Eclipse Milo versions 0.6.0 through 1.1.4 should prioritize patching to prevent unauthorized access to OPC UA server diagnostics nodes.

Recommended defensive actions

• Apply patches from Eclipse to address the vulnerability in Milo versions 0.6.0 through 1.1.4.
• Restrict access to OPC UA server diagnostics nodes to authorized clients only.
• Monitor OPC UA server diagnostics nodes for unauthorized access attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description indicates that Eclipse Milo versions 0.6.0 through 1.1.4 have a vulnerability where OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

Official resources