PatchTheCVECVE-2026-63248: In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorizat
32
Routine
MEDIUM 6.5REMOTEUPGRADE
CVE-2026-63248 is a medium-severity flaw (CVSS 6.5) affecting milo. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certifi
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 83%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-08-04 |
| Last modified | 2026-10-23 |
Publisher (CNA): Eclipse Foundation · Vendor: eclipse
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
eclipse milo UPGRADE
Affected: >= 0.6.0 and < 1.1.5
Fixed in: 1.1.5
Safe to downgrade to: a release before 0.6.0
1. Check installed version
apt-cache policy milo || rpm -q milo || milo --version
2. UPGRADE to 1.1.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade milo
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade milo
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.6.0 (Debian / Ubuntu)
apt-cache madison milo
sudo apt install milo=<VERSION_BEFORE_0.6.0>
sudo apt-mark hold milo
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list milo
sudo dnf downgrade milo-<VERSION_BEFORE_0.6.0>
sudo dnf versionlock add milo
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Advisories and coverage
Official advisories
- CISA ICS Advisories: Eclipse Foundation Eclipse Milo 2026-10-15
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-61387 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item c
- CVE-2026-63252 HIGH 7.5 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial
- CVE-2026-60007 HIGH 7.4 UPGRADE In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for inv
- CVE-2026-58080 HIGH 8.2 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleM
- CVE-2026-62927 HIGH 7.5 UPGRADE In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-