CVE-2026-12897General

LOWCVSS 8.4 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-03

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-06-25); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Active Exploitation

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-25	1	General1
2026-06-27	1	Active Exploitation1

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc90d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-12897 in Horner Automation Cscape via malicious CSP files to achieve code execution and escalate privileges. Post-compromise lateral movement across industrial networks amplifies blast radius. Runtime segmentation helps contain such breach chains. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-176-03-cve-2026-12897
Post summary
Attackers are actively exploiting CVE‑2026‑12897 in Horner Automation Cscape using malicious CSP files to gain code execution and privilege escalation, demonstrating a real‑world threat.
0000052
1.9K followersView on X
WindowsForum.com@windowsforum92d
General
🪟 “Local only” CVEs are how factories get quietly pwned—because engineering laptops are basically Windows PCs with fewer backups and worse patch discipline. Treat it like a real threat. #Windows #Microsoft #CVE #OT #Security https://windowsforum.com/threads/cve-2026-12897-cisa-warns-horner-cscape-csp-files-can-enable-code-execution-local.430559/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity https://t.co/1pqofenBaj
Post summary
The tweet warns that local-only CVEs can quietly compromise factory systems, emphasizing the need for better patch discipline.
0000046
1.2K followersView on X

Explore more

Back to dashboard