PatchTheCEVCVE-2026-60007: In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for inv
42
This month
HIGH 7.4REMOTEUPGRADE
CVE-2026-60007 is a high-severity flaw (CVSS 7.4) affecting milo. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.4 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 55%) |
| CISA exploited list | No |
| Weakness | CWE-204 |
| Published | 2026-08-04 |
| Last modified | 2026-10-23 |
Publisher (CNA): Eclipse Foundation · Vendor: eclipse
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
eclipse milo UPGRADE
Affected: >= 0.6.0 and < 1.1.5
Fixed in: 1.1.5
Safe to downgrade to: a release before 0.6.0
1. Check installed version
apt-cache policy milo || rpm -q milo || milo --version
2. UPGRADE to 1.1.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade milo
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade milo
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.6.0 (Debian / Ubuntu)
apt-cache madison milo
sudo apt install milo=<VERSION_BEFORE_0.6.0>
sudo apt-mark hold milo
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list milo
sudo dnf downgrade milo-<VERSION_BEFORE_0.6.0>
sudo dnf versionlock add milo
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Advisories and coverage
Official advisories
- CISA ICS Advisories: Eclipse Foundation Eclipse Milo 2026-10-15
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-61387 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item c
- CVE-2026-63252 HIGH 7.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial
- CVE-2026-58080 HIGH 8.2 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleM
- CVE-2026-62927 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-
- CVE-2026-63248 MEDIUM 6.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorizat