# CISA warns of flaws in ANDRITZ HIPASE-250

Published: 2026-08-13 · Severity: routine · Sectors: energy
Canonical: https://vorant.io/reports/b39ce700-caf7-5dd3-99d2-062ec248a0e9/cisa-warns-of-flaws-in-andritz-hipase-250

> Four vulnerabilities in ANDRITZ HIPASE-250/250 SCALA ICS software could let attackers steal credentials, read live process data, hide log activity, or gain VNC access via a hard-coded password.

CISA published an advisory detailing four vulnerabilities affecting ANDRITZ HIPASE-250 and 250 SCALA, an industrial control system product used in the energy sector worldwide, with ANDRITZ headquartered in Austria. The flaws range from reversible password storage (CVE-2026-65309) and unauthenticated exposure of process/configuration data with permissive CORS (CVE-2026-65310), to an unauthenticated endpoint that can suppress audit logging to conceal attacker activity (CVE-2026-65311), and a hard-coded x11vnc password applied uniformly to engineering workstations during provisioning (CVE-2026-65313).

Combined, these issues could allow an attacker with network access to recover stored credentials, read live process and server configuration data without authentication, tamper with logging to hide malicious activity, and ultimately gain VNC access to affected workstations. The vulnerabilities were reported to CISA by researchers from NTCS OT Penetration Testing Team. ANDRITZ has released fixes in versions V8.00.00 (Dec 2024) and V8.15.00 (Jul 2026), and CISA recommends standard ICS network isolation and VPN best practices as mitigations. No known public exploitation has been reported at this time.

## Mentioned in this report

- Vulnerabilities: CVE-2026-65309, CVE-2026-65310, CVE-2026-65311, CVE-2026-65313

## Detection guidance (public sample)

### Unauthenticated Audit Logging Suppression via HIPASE-250

ATT&CK: T1562.002

Detects HTTP requests to HIPASE-250 endpoints that disable or suppress audit logging without authentication, characteristic of CVE-2026-65311 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated Audit Logging Suppression via HIPASE-250
description: Detects unauthenticated HTTP requests to HIPASE-250 endpoints designed
  to suppress or disable audit logging (CVE-2026-65311). Targets the distinctive pattern
  of accessing logging-control endpoints without valid credentials.
tags:
- attack.defense-evasion
- attack.t1562.002
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    DestinationHostname|contains:
    - hipase
    DestinationPort: 80
    RequestPath|contains:
    - logging
    - audit
    - disable
    - suppress
    HttpRequestMethod: GET
  filter_authenticated:
    RequestHeader|contains: Authorization
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate administrative access to logging configuration via VPN with headers stripped
  in logs
level: high
id: 94e83033-70a6-5c1b-8d23-f285cea8b9ba
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b39ce700-caf7-5dd3-99d2-062ec248a0e9/cisa-warns-of-flaws-in-andritz-hipase-250.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup