Passenger rail and transit
Cyber advisories, exploited vulnerabilities and rules that touch passenger rail and transit operators. Items are matched to this mode by a published vendor and agency table; each item says why it is here.
New items per week, passenger rail and transit
Advisories and known-exploited or new vulnerabilities on this page, by the week they appeared. The last week is still in progress. Other modes: use the menu at the top.
Rules and directives
- Not yet labeledNoticeRevision of Agency Information Collection Activity Under OMB Review: Cybersecurity Measures for Surface Modes
- Proposed changeProposed RuleTown Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking
- Mandatory requirementSecurity DirectiveCurrent revisionSD 1580/82 2022-01E: Rail Cybersecurity Mitigation Actions and Testing
- Not yet labeledNoticeIntent To Request a Revision From OMB of One Current Public Collection of Information: Cybersecurity Measures for Surface Modes
- Proposed changeProposed RuleCyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking; Town Hall Meetings
- Mandatory requirementSecurity DirectiveCurrent revisionSD 1582-21-01E: Enhancing Public Transportation and Passenger Railroad Cybersecurity
More rules and directives (12)
- Not yet labeledNoticeRequest for Comment on the National Cyber Incident Response Plan Update
- Not yet labeledNoticeRequest for Comment on the National Cyber Incident Response Plan Update
- Proposed changeProposed RuleEnhancing Surface Cyber Risk Management
- Proposed changeProposed RuleCyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements; Correction
- Not yet labeledNoticeNotice of Meeting; Cybersecurity Advisory Committee
- Proposed changeProposed RuleCyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements; Extension of Comment Period
- Proposed changeProposed RuleCyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements
- Not yet labeledNoticeNotice of Cybersecurity and Infrastructure Security Agency Cybersecurity Advisory Committee Meeting
- Not yet labeledNoticeRequest for Information on “Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software”
- Not yet labeledNoticeNotice of Cybersecurity and Infrastructure Security Agency Cybersecurity Advisory Committee Meeting
- Mandatory requirementRegulation text (eCFR)49 CFR part 1582: Public Transportation and Passenger Railroad Security
- Mandatory requirementRegulation text (eCFR)49 CFR part 1520: Protection of Sensitive Security Information
Reported incidents
Public reports of cyber incidents at transportation operators. Each is labeled: Confirmed by the operator, Government statement (CISA, FBI, TSA or Coast Guard), Reported by media (headline, publisher, date and link only) or Analyst inference.
No reported incidents for this mode yet.
Industrial control advisories
CISA ICS advisories from the last 90 days whose vendor is on this mode's list.
No advisories for this mode's vendors in the last 90 days. The vendor list is a starting list and will grow.
Industrial control makers used in every mode (54)
- Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 83%SSA-045512: Node2Shell Vulnerability in Siemens Products
- Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 83%SSA-443410: Node2Shell Vulnerability in Industrial Edge Management Applications
- Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 83%SSA-898633: Node2Shell Vulnerability in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
- Industrial control advisorySeverity 7.5 highHitachi Energy TRO600 series products
- Industrial control advisorySeverity 8.8 highExploit likelihood 94%Hitachi Energy CoreTec Product
- Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 100%SSA-166980: PHP2Shell Vulnerabilities in Siemens Products
- Industrial control advisorySeverity 6.8 mediumSiemens Mendix SAML Module
- Vendor advisoryKnown exploitedExploit likelihood 100%SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products
- Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 100%SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
- Industrial control advisoryKnown exploitedSeverity 6.7 mediumSiemens Software Center
- Industrial control advisoryKnown exploitedSeverity 9.1 criticalExploit likelihood 100%Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
- Industrial control advisoryKnown exploitedSeverity 10.0 criticalExploit likelihood 38%Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
- Industrial control advisoryKnown exploitedSeverity 10.0 criticalExploit likelihood 38%Siemens SIMATIC S7-1500 TM MFP
- Industrial control advisorySeverity 8.3 highSiemens Industrial Edge App Publisher
- Industrial control advisorySeverity 5.3 mediumSiemens Capital Embedded AR Classic
- Industrial control advisorySeverity 5.8 mediumSiemens SENTRON 3NA COM Fuse
- Industrial control advisorySeverity 7.0 highSiemens PSS(R)SINCAL
- Industrial control advisorySeverity 7.7 highSiemens SIMATIC IPCs
- Industrial control advisorySeverity 8.2 highSiemens APOGEE, TALON and Desigo PXC/PXM Products
- Industrial control advisorySeverity 9.1 criticalSiemens Industrial Edge Device Kit
- Industrial control advisorySeverity 7.5 highSiemens SIMATIC S7 Webserver API
- Industrial control advisorySeverity 8.8 highSiemens RUGGEDCOM CROSSBOW
- Industrial control advisorySeverity 8.8 highSiemens WinCC
- Industrial control advisorySeverity 9.6 criticalSiemens SIMATIC S7 PLCs Web Server
- Industrial control advisorySeverity 9.8 criticalExploit likelihood 73%Siemens RUGGEDCOM CROSSBOW Station Access Controller
- Industrial control advisorySeverity 9.1 criticalSiemens Industrial Edge Devices
- Industrial control advisorySeverity 7.5 highSiemens RUGGEDCOM APE1808 Devices
- Industrial control advisoryKnown exploitedSeverity 8.8 highExploit likelihood 98%Hitachi Energy SOI
- Industrial control advisorySeverity 8.1 highHitachi Energy Asset Suite
- Industrial control advisorySeverity 6.5 mediumHitachi Energy REB500
- Industrial control advisorySeverity 9.8 criticalExploit likelihood 81%Hitachi Energy RTU500
- Industrial control advisorySeverity 8.8 highMitsubishi Electric GX Works3 and Motion Control Settings
- Industrial control advisorySeverity 6.5 mediumSiemens WTV676 and WTV776
- Industrial control advisoryKnown exploitedSeverity 7.8 highExploit likelihood 98%Siemens SIPLUS and SIMATIC Products
- Industrial control advisorySeverity 9.8 criticalSiemens Reyrolle 7SR5
- Industrial control advisorySeverity 6.1 mediumSiemens Teamcenter
- Industrial control advisorySeverity 9.0 criticalSiemens Siveillance Control
- Industrial control advisorySeverity 8.2 highSiemens Desigo CC family
- Industrial control advisorySeverity 9.1 criticalSiemens Industrial Edge Management
- Industrial control advisorySeverity 8.6 highSiemens SIMOVE Fleetmanager and SIPLANT
- Industrial control advisorySeverity 7.3 highRockwell Automation ControlFLASH
- Industrial control advisorySeverity 7.5 highRockwell Automation ArmorStart LT
- Industrial control advisorySeverity 7.5 highRockwell Automation 1756-ENBT Module
- Industrial control advisorySeverity 8.7 highSiemens Mendix SAML
- Industrial control advisorySeverity 8.6 highRockwell Automation RSLinx Classic
- Industrial control advisorySeverity 7.3 highRockwell Automation Redundancy Module Configuration Tool
- Industrial control advisorySeverity 7.5 highRockwell Automation Logix Platform
- Industrial control advisorySeverity 7.8 highRockwell Automation FactoryTalk Activation Manager
- Industrial control advisorySeverity 7.5 highRockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix
- Industrial control advisorySeverity 8.0 highRockwell Automation Historian ME
- Industrial control advisorySeverity 7.8 highHitachi Energy MicroSCADA X SYS600 Product
- Industrial control advisorySeverity 8.8 highHitachi Energy RTU500 Product
- Industrial control advisorySeverity 6.8 mediumRockwell Automation OTTO Fleet Manager
- Cybersecurity advisoryDefending Against an Active Threat to Siemens S7 Series PLCs
Network and remote-access gear used in every mode (25)
- Vendor advisorySeverity 5.3 mediumCisco Identity Services Engine Authorization Bypass Vulnerability
- Vendor advisoryLinux kernel RCE CVE-2026-98432
- Vendor advisoryCisco Advance Notification for Publication of November 4, 2026, Security Advisories
- Vendor advisoryKnown exploitedSeverity 7.4 highExploit likelihood 83%Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
- Vendor advisoryNode2Shell CVEs
- Vendor advisoryCisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
- Vendor advisoryKnown exploitedExploit likelihood 100%Vulnerabilities in PHP Affecting Cisco Products: October 2026
- Vendor advisoryKnown exploitedSeverity 5.3 mediumExploit likelihood 100%PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
- Industrial control advisorySeverity 8.1 highMoxa AIG-302 ThingsPro Edge
- Cybersecurity advisoryCISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure
- Vendor advisorySeverity 4.8 mediumPersistent Denial of Service in Admin Profile
- Vendor advisorySeverity 5.3 mediumarbitrary command execution in fgfmsd daemon
- Vendor advisorySeverity 7.9 highMultiple Arbitrary File Read/Write via SQL Injection
- Vendor advisorySeverity 4.9 mediumFabric API Authentication bypass
- Vendor advisorySeverity 9.4 criticalArbitrary file write in grpc phQueryMaster
- Vendor advisorySeverity 6.7 mediumGUI Denial of Service
- Vendor advisorySeverity 2.1 lowDouble free in signal handler
- Vendor advisorySeverity 3.4 lowBroken authorization
- Vendor advisorySeverity 7.7 highSQL command injection in webmail
- Vendor advisorySeverity 9.6 criticalImproper access control and session management in the web management interface
- Vendor advisorySeverity 9.8 criticalCisco NX-OS Software Security Hardening Release: October 2026
- Vendor advisorySeverity 9.8 criticalCisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities
- Vendor advisoryKnown exploitedSeverity 9.8 criticalImproper limitation of a pathname to a restricted directory
- Cybersecurity advisoryCritical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
- Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 40%Cisco Secure Email Gateway SQL Injection Vulnerability
Known exploited vulnerabilities
Added to CISA's Known Exploited Vulnerabilities list in the last 90 days.
None specific to this mode in the last 90 days.
Network and remote-access gear used in every mode (16)
- VulnerabilityKnown exploitedIvanti Connect Secure Missing Authentication for Critical Function Vulnerability
- VulnerabilityKnown exploitedSeverity 4.3 mediumIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- VulnerabilityKnown exploitedCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- VulnerabilityKnown exploitedFortinet Multiple Products Path Traversal Vulnerability
- VulnerabilityKnown exploitedPalo Alto Networks PAN-OS Code Injection Vulnerability
- VulnerabilityKnown exploitedCisco Secure Email Gateway Relative Path Traversal Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 89%Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 11%Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 39%Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 82%Citrix NetScaler Improper Input Validation Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 77%Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 76%Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- VulnerabilityKnown exploitedFortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 33%Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- VulnerabilityKnown exploitedExploit likelihood 89%Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- VulnerabilityKnown exploitedCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
New vulnerabilities
New CVE records from the last 30 days for vendors on this mode's list.
None specific to this mode in the last 30 days.
Network and remote-access gear used in every mode (26)
- VulnerabilitySeverity 6.1 mediumCisco Unified Communications Manager Cross-Site Scripting Vulnerability
- VulnerabilitySeverity 7.6 highCisco Unified Computing System Central Remote Code Execution Vulnerability
- VulnerabilitySeverity 7.6 highUnauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
- VulnerabilitySeverity 7.7 highStatic HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
- VulnerabilitySeverity 7.5 highSMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
- VulnerabilitySeverity 5.3 mediumMoxa NPort W2150A-W4/W2250A-W4 Series
- VulnerabilitySeverity 9.0 criticalMultiple Cisco Products Snort 3 Software Hardening Release: October 2026
- VulnerabilitySeverity 7.5 highMultiple Cisco Products Snort 3 Software Hardening Release: October 2026
- VulnerabilitySeverity 7.8 highMultiple Cisco Products Snort 3 Software Hardening Release: October 2026
- VulnerabilitySeverity 7.5 highMultiple Cisco Products Snort 3 Software Hardening Release: October 2026
- VulnerabilitySeverity 9.8 criticalCisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
- VulnerabilitySeverity 9.8 criticalCisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
- VulnerabilitySeverity 9.3 criticalCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
- VulnerabilitySeverity 8.8 highCisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
- VulnerabilitySeverity 8.8 highCisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities
- VulnerabilitySeverity 8.8 highCisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
- VulnerabilitySeverity 7.8 highCisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities
- VulnerabilitySeverity 7.5 highCisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities
- VulnerabilitySeverity 8.6 highCisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
- VulnerabilitySeverity 7.5 highCisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities
- VulnerabilitySeverity 7.5 highCisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities
- VulnerabilitySeverity 7.5 highCisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities
- VulnerabilitySeverity 7.8 highCisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities
- VulnerabilitySeverity 7.8 highCisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities
- VulnerabilitySeverity 7.0 highCisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities
- VulnerabilitySeverity 6.6 mediumCisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities