Horner Cscape OOB read enables code execution
Horner Automation Cscape versions before 10.2 SP3 contain an out-of-bounds read vulnerability in CSP file parsing that allows local attackers to disclose information and execute code.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory for CVE-2026-12897, an out-of-bounds read vulnerability in Horner Automation Cscape software used in critical manufacturing environments. The flaw affects all versions prior to 10.2 SP3 and is triggered through parsing malicious CSP project files. Successful exploitation enables a local attacker to disclose sensitive information and execute arbitrary code on affected systems.
The vulnerability was reported by researcher Michael Heinzl and affects Cscape deployments worldwide, primarily in critical manufacturing sectors. Horner Automation has released version 10.2 SP3 to address the issue. While the vulnerability requires local access and no public exploitation has been reported to CISA, the potential for code execution in industrial control system environments warrants prompt patching.
Organizations using affected Cscape versions should upgrade to 10.2 SP3 and follow CISA's standard ICS security recommendations, including network segmentation, minimizing internet exposure of control systems, and implementing defense-in-depth strategies for industrial environments.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Horner Cscape (Possible CVE-2026-12897 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Cscape.exe (Horner Automation ICS engineering software) spawning shell or scripting interpreters shortly after startup, consistent with code execution following parsing of a malicious CSP project file exploiting the OOB read vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Horner Cscape
id: 3e24ec48-e99e-52d2-b19b-cd5ea877fe8e
status: experimental
description: Detects Cscape.exe spawning command interpreters, scripting engines,
or living-off-the-land binaries which is not normal behaviour for this ICS engineering
application and may indicate exploitation of an out-of-bounds read vulnerability
(CVE-2026-12897) triggered by a malicious CSP project file leading to code execution.
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \Cscape.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \wscript.exe
- \cscript.exe
- \rundll32.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
condition: selection
falsepositives:
- Legitimate administrative scripting integrated into engineering workflows (uncommon)
- Third-party plugins or macros intentionally invoking scripting tools from within
Cscape
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Horner Cscape Application Crash Possibly Indicating Exploitation Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Windows Error Reporting invocation against Cscape.exe, which may indicate a crash caused by a malformed CSP project file attempting to trigger the out-of-bounds read vulnerability (CVE-2026-12897). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cscape Application Crash via WerFault
id: 1e39d305-6b25-54f2-906b-a3a935a58d03
status: experimental
description: Detects WerFault.exe being invoked to handle a crash of Cscape.exe, the
Horner Automation ICS engineering application. Repeated crashes when opening CSP
project files may indicate attempted exploitation of an out-of-bounds read vulnerability
(CVE-2026-12897) prior to achieving stable code execution.
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \WerFault.exe
CommandLine|contains: Cscape.exe
condition: selection
falsepositives:
- Genuine application instability or crashes unrelated to malicious input
- Corrupted or incompatible legitimate CSP project files causing parser errors
level: medium
tags:
- attack.t1203
- attack.execution
author: Vorant
Cscape Opening Project File from Removable or Untrusted Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Cscape.exe being launched with a CSP project file argument located on removable media, network shares, or temp/download directories, a common delivery vector for a malicious file exploiting the parsing vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cscape Launched with CSP File from Untrusted Location
id: b82e0022-8bbb-5578-8f02-beb5cdd46944
status: experimental
description: Detects Cscape.exe being started with a command line referencing a .csp
project file located in temp, downloads, removable drives, or network share paths,
which is an unusual delivery pattern for engineering project files and may indicate
an attempt to exploit CVE-2026-12897 via a crafted CSP file.
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \Cscape.exe
CommandLine|contains: .csp
suspicious_path:
CommandLine|contains:
- :\Users\
- \AppData\Local\Temp\
- \Downloads\
- \\
condition: selection and suspicious_path
falsepositives:
- Engineers legitimately opening project files stored in user profile or shared network
engineering repositories
- Standard file transfer workflows via USB drives common in ICS environments
level: low
tags:
- attack.t1203
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs