ABB Ability Zenon software contains an authentication bypass vulnerability allowing…

26 May 2026 medium vulnerability energyhealthcareinfrastructuremanufacturingtechnology

ABB Ability Zenon software contains an authentication bypass vulnerability allowing unauthorized system reboots, affecting versions 7.50 through 14 across critical infrastructure.

ABB has disclosed a vulnerability in its Ability Zenon software platform affecting versions 7.50 through 14. The vulnerability exists in the Remote Transport Service component, specifically the zensyssrv.exe service that starts automatically in default configurations. An attacker who has already gained access to the network where the affected system is deployed can bypass authentication mechanisms and remotely trigger system reboots without authorization. While users are required to configure a password to utilize the Remote Transport Service, the vulnerability allows attackers to circumvent this protection.

The vulnerability is classified as a missing authentication issue for a critical function. Remote exploitation requires the attacker to have already compromised the network perimeter, limiting the attack surface to insider threats or actors who have gained initial network access through other means. ABB reports no evidence of active exploitation in the wild at the time of publication.

ABB recommends restricting network access to systems running the Zenon platform and evaluating whether the Remote Transport functionality is necessary. If not required, organizations should stop or terminate the zensyssrv.exe service. The vulnerability impacts critical infrastructure sectors including chemical, energy, healthcare, manufacturing, water, and IT systems deployed worldwide.

Mentioned in this report

Vulnerabilities CVE-2025-8754

Detection guidance

Suspicious Termination of ABB Zenon Remote Transport Service (zensyssrv.exe)

ATT&CK T1489

Detects command-line service stop/kill actions targeting the ABB Zenon zensyssrv.exe process, which may indicate exploitation of the authentication bypass to disable the Remote Transport Service or mask further tampering. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Termination of ABB Zenon zensyssrv Service
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \taskkill.exe
    - \sc.exe
    - \net.exe
    - \net1.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: zensyssrv
  selection_action:
    CommandLine|contains:
    - stop
    - /im
    - /f
    - Stop-Service
    - kill
  condition: selection_process and selection_action
falsepositives:
- Legitimate administrative maintenance stopping the Remote Transport Service as recommended
  by ABB mitigation guidance
- Scheduled patching or service reconfiguration scripts
level: medium
tags:
- attack.t1489
- attack.impact
id: e68a9fbb-d1a0-570b-bd0f-ccf7cc18d254
status: experimental
author: Vorant

ABB Zenon Remote Transport Service Unexpected Stop (Service Control Manager)

ATT&CK T1489

Detects Windows Service Control Manager events indicating the zensyssrv (ABB Zenon Remote Transport) service stopped unexpectedly, which may indicate exploitation of the missing-authentication vulnerability to disrupt the service or precede an unauthorized reboot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ABB Zenon zensyssrv Service Stopped Unexpectedly
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID:
    - 7036
    - 7035
    - 7034
    Message|contains: zensyssrv
  condition: selection
falsepositives:
- Planned maintenance or intentional disabling of the Remote Transport Service per
  vendor hardening guidance
- Service crash due to unrelated software fault
level: medium
tags:
- attack.t1489
- attack.impact
id: fd3b1004-adae-5f09-b3c0-643871900a4f
status: experimental
author: Vorant

System Reboot Initiated Shortly After zensyssrv.exe Network Activity

ATT&CK T1489

Detects a system reboot/shutdown command execution occurring in close proximity to zensyssrv.exe process activity, consistent with exploitation of the ABB Zenon Remote Transport authentication bypass to force an unauthorized reboot. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Reboot Command Following ABB Zenon zensyssrv Activity
logsource:
  category: process_creation
  product: windows
detection:
  selection_reboot:
    Image|endswith:
    - \shutdown.exe
    CommandLine|contains:
    - /r
    - /f
    - -r
  selection_zenon:
    Image|endswith: \zensyssrv.exe
  condition: selection_reboot and selection_zenon
falsepositives:
- Legitimate scheduled reboots on systems running Zenon that coincide with normal
  maintenance windows
- Administrator-initiated reboot for patching co-located with zensyssrv.exe process
  presence
level: low
tags:
- attack.t1489
- attack.impact
id: 6400d617-67e5-5e5b-91af-ea5a226824af
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-03

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free