Horner Cscape OOB read enables code execution
Horner Automation Cscape versions before 10.2 SP3 contain an out-of-bounds read vulnerability in CSP file parsing that allows local attackers to disclose information and execute code.
CISA has published an advisory for CVE-2026-12897, an out-of-bounds read vulnerability in Horner Automation Cscape software used in critical manufacturing environments. The flaw affects all versions prior to 10.2 SP3 and is triggered through parsing malicious CSP project files. Successful exploitation enables a local attacker to disclose sensitive information and execute arbitrary code on affected systems.
The vulnerability was reported by researcher Michael Heinzl and affects Cscape deployments worldwide, primarily in critical manufacturing sectors. Horner Automation has released version 10.2 SP3 to address the issue. While the vulnerability requires local access and no public exploitation has been reported to CISA, the potential for code execution in industrial control system environments warrants prompt patching.
Organizations using affected Cscape versions should upgrade to 10.2 SP3 and follow CISA's standard ICS security recommendations, including network segmentation, minimizing internet exposure of control systems, and implementing defense-in-depth strategies for industrial environments.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Horner Cscape (Possible CVE-2026-12897 Exploitation)
Detects Cscape.exe (Horner Automation ICS engineering software) spawning shell or scripting interpreters shortly after startup, consistent with code execution following parsing of a malicious CSP project file exploiting the OOB read vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Horner Cscape
id: 3e24ec48-e99e-52d2-b19b-cd5ea877fe8e
status: experimental
description: Detects Cscape.exe spawning command interpreters, scripting engines,
or living-off-the-land binaries which is not normal behaviour for this ICS engineering
application and may indicate exploitation of an out-of-bounds read vulnerability
(CVE-2026-12897) triggered by a malicious CSP project file leading to code execution.
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \Cscape.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \powershell_ise.exe
- \wscript.exe
- \cscript.exe
- \rundll32.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
condition: selection
falsepositives:
- Legitimate administrative scripting integrated into engineering workflows (uncommon)
- Third-party plugins or macros intentionally invoking scripting tools from within
Cscape
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Horner Cscape Application Crash Possibly Indicating Exploitation Attempt
Detects Windows Error Reporting invocation against Cscape.exe, which may indicate a crash caused by a malformed CSP project file attempting to trigger the out-of-bounds read vulnerability (CVE-2026-12897). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cscape Application Crash via WerFault
id: 1e39d305-6b25-54f2-906b-a3a935a58d03
status: experimental
description: Detects WerFault.exe being invoked to handle a crash of Cscape.exe, the
Horner Automation ICS engineering application. Repeated crashes when opening CSP
project files may indicate attempted exploitation of an out-of-bounds read vulnerability
(CVE-2026-12897) prior to achieving stable code execution.
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \WerFault.exe
CommandLine|contains: Cscape.exe
condition: selection
falsepositives:
- Genuine application instability or crashes unrelated to malicious input
- Corrupted or incompatible legitimate CSP project files causing parser errors
level: medium
tags:
- attack.t1203
- attack.execution
author: Vorant
Cscape Opening Project File from Removable or Untrusted Path
Detects Cscape.exe being launched with a CSP project file argument located on removable media, network shares, or temp/download directories, a common delivery vector for a malicious file exploiting the parsing vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cscape Launched with CSP File from Untrusted Location
id: b82e0022-8bbb-5578-8f02-beb5cdd46944
status: experimental
description: Detects Cscape.exe being started with a command line referencing a .csp
project file located in temp, downloads, removable drives, or network share paths,
which is an unusual delivery pattern for engineering project files and may indicate
an attempt to exploit CVE-2026-12897 via a crafted CSP file.
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \Cscape.exe
CommandLine|contains: .csp
suspicious_path:
CommandLine|contains:
- :\Users\
- \AppData\Local\Temp\
- \Downloads\
- \\
condition: selection and suspicious_path
falsepositives:
- Engineers legitimately opening project files stored in user profile or shared network
engineering repositories
- Standard file transfer workflows via USB drives common in ICS environments
level: low
tags:
- attack.t1203
- attack.execution
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-03
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free