As reported by CISA in advisory ICSA-26-195-03, ABB has disclosed a cluster of four significant vulnerabilities affecting its T-MAC Plus industrial communications platform — a product widely deployed in critical manufacturing environments globally. With a vendor-assigned CVSS v3 score reaching 9.9 (Critical), these vulnerabilities represent a serious and immediate risk to operational technology (OT) environments that cannot afford downtime or compromise.

Security Impact: As reported by CISA in advisory ICSA-26-195-03, ABB has disclosed a cluster of four significant vulnerabilities affecting its T-MAC Plus industrial communications platform — a product widely deployed in critical manufacturing environments globally.

Vulnerability Summary

Affected Product
ABB T-MAC Plus, version 4.0-24
CVE Identifiers
CVE-2025-14771, CVE-2025-14772, CVE-2025-14773, CVE-2025-14774
CVSS v3 Score
9.9 — Critical
Vulnerability Types
Vulnerability Summary
CVE-2025-14771: Files or Directories Accessible to External Parties — file disclosure allowing authenticated users to exfiltrate sensitive data
CVE-2025-14772: Authorization Bypass Through User-Controlled Key — enables privilege escalation or unauthorized action execution
CVE-2025-14773: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) — XSS vector in the web application interface
CVE-2025-14774: Incorrect Authorization — logic flaws permitting unauthorized access to protected functionality
Patch Available
Yes — ABB has released an update resolving all four CVEs. Organizations should consult the CISA advisory and ABB's official security portal for patching guidance.
Active Exploitation Observed
Not publicly confirmed at time of writing; however, given the critical CVSS score and the OT/ICS context, treat this as high urgency regardless.
Deployment Scope
Worldwide — Critical Manufacturing sector

Why This Matters Beyond the Patch Bulletin

The T-MAC Plus is an industrial communications gateway used to bridge legacy serial protocols with modern Ethernet-based control networks. Its role at the convergence of IT and OT makes it a high-value target — compromise of this type of device can grant attackers lateral movement capabilities into otherwise air-gapped or segmented control environments.

What makes this advisory particularly concerning is the combination of vulnerability classes disclosed. The authorization bypass (CVE-2025-14772) paired with incorrect authorization logic (CVE-2025-14774) creates a compounding attack path: an adversary may not need elevated credentials to access sensitive file paths exposed by CVE-2025-14771. The XSS vector (CVE-2025-14773) adds a social engineering dimension, potentially enabling session hijacking against engineers or operators accessing the device's web interface.

In OT environments, a single compromised communications gateway can cascade into loss of visibility, manipulated process data, or physical impact. These are not theoretical risks.

Nation-state actors and ransomware groups with OT capabilities — including those targeting manufacturing supply chains — actively scan for exposed ICS web interfaces. The timing of this disclosure, mid-2026, places it squarely within an elevated threat environment for industrial operators.

Who Is Most at Risk

  • Critical manufacturing facilities using ABB automation products in assembly, processing, or utility control roles
  • Organizations where T-MAC Plus devices are accessible from engineering workstations or broader corporate networks without strict micro-segmentation
  • Sites with delayed patch cycles due to production uptime requirements — a common and exploitable gap in OT security programs
  • Environments where web-based HMI or management interfaces are exposed beyond the immediate control network

Shield53 Recommendations

Immediate Actions

  • Apply the ABB patch immediately for T-MAC Plus version 4.0-24. Coordinate with ABB support or your system integrator if a maintenance window is required — but do not delay beyond 72 hours for internet-facing or network-adjacent deployments.
  • Audit network exposure: Determine whether T-MAC Plus web interfaces are reachable from any IT network segment, remote access VPN, or the internet. Restrict access to OT-only segments with strict ACLs.
  • Review authenticated user access logs on affected devices for any anomalous file access or unusual session activity, particularly given the file disclosure vector in CVE-2025-14771.
  • Disable or restrict web interface access on devices where the management GUI is not operationally necessary, as a temporary risk reduction measure ahead of patching.
  • Deploy network-level XSS and anomalous authentication detection on traffic to/from T-MAC Plus devices using your OT-aware IDS/IPS platform (e.g., Claroty, Dragos, Nozomi).

Longer-Term Posture

  • Establish a dedicated ICS vulnerability management workflow that doesn't wait for CISA advisories — subscribe to ABB's product security notifications directly.
  • Conduct a full communications gateway inventory across your OT environment; devices like T-MAC Plus are often underdocumented in asset registries.
  • Implement zero-trust principles at the OT boundary: authenticated access to ICS web interfaces should require MFA and be logged and monitored in your SOC.
The window between public ICS vulnerability disclosure and active exploitation continues to narrow. For critical manufacturing operators, the only acceptable response to a CVSS 9.9 advisory with available patches is immediate action — not a deferred maintenance queue.