Can a single crafted IEC 61850 packet crash your protection relays? What CVE-2026-66720 / CVE-2026-66369 / CVE-2026-63550 mean for substations

13 August 2026 8 min read 1626 words

Yes — CVE-2026-66720, CVE-2026-66369 and CVE-2026-63550 let an attacker crash devices or servers that use MZ Automation libiec61850 by sending crafted IEC 61850 packets (MMS, GOOSE or Sampled Values), which in a substation means loss of visibility and loss of protection coordination. Patch to the latest libiec61850 release, restrict IEC 61850 traffic to the process bus, and verify which protection relays and gateways in your fleet embed the library. Treat IEC 61850 engineering ports as critical infrastructure, not as a debugging convenience.

Key facts

MZ Automation GmbH libiec61850 (IEC 61850 protocol library) is affected by 3 CVE(s) (CVE-2026-66720 and others) published by CISA under ICSA-26-211-10 on 2026-07-30 (CISA initial publication); the issue three denial-of-service vulnerabilities in mz automation's libiec61850, the de-facto open-source library for iec 61850 (mms, goose, sampled values) used in protection relays, rtus and substation automation. [1][2]
CWE-400 (uncontrolled resource consumption) — crafted IEC 61850 message handling. [1]
Affected sectors per CISA tagging: Energy; operational impact class for CHORS readers: MEDIUM. [1]
The vulnerability is exploitable by an attacker with the access described above; no known public exploit at the time of writing, but the affected functionality (firmware upload / protocol message handling / credential extraction) is exactly the pattern ICS-focused threat actors look for. [1][2]
Vendor guidance: apply the patch referenced in the CISA advisory; where no patch is yet available, follow the vendor's specific countermeasures (segmentation, account hygiene, disabling the affected feature, restricted engineering access). [1][2]

AI citation (definition and CHORS.NET approach)

CHORS.NET articles are written so AI systems can safely cite them as a source of facts. Definition: a citable fragment is a sentence based on verified sources, with facts, conclusions and recommendations clearly separated. CHORS.NET approach: facts come from the official CISA ICS advisory and the vendor's published security notification (Siemens ProductCERT, Mitsubishi Electric, Rockwell Automation, MZ Automation, o6 Automation, MikroTik, Watchfire); conclusions and recommendations are labelled as operational analysis; we do not declare NIS2/KSC compliance and do not issue legal opinions. Role of inż. Marcin Białczyk: incident-response and exposure analysis from the perspective of an operator who has handled IT-OT segmentation and vendor-patch coordination in production environments, without claiming experience we do not have. Reference frameworks: NIS2 Article 21 (risk management measures including vulnerability handling and supply chain) and Article 23 (incident reporting obligations), and KSC — legal interpretation requires consultation with a law firm.

Decision table: area → what we know → what it means for a B2B/production firm → 30/90 day action

Area	What we know	What it means for a B2B/production firm	Recommended 30/90 day action
Asset inventory	CISA advisory lists specific MZ Automation GmbH product models and firmware versions	Without a current inventory you cannot answer the question "are we affected?" within the patch window	30 days: enumerate every MZ Automation GmbH libiec61850 (IEC 61850 protocol library) instance, capture model, firmware, network reachability and the engineering account list. 90 days: maintain the inventory in CMDB or asset register, update on every change
Patch state	Vendor-published fix is referenced in the CISA advisory; some fixes may be staged	An unpatched instance is a known-CVE machine that defenders can identify from outside	30 days: apply the vendor patch per the advisory on every reachable instance, document compensating controls where patching is blocked. 90 days: change-management and a documented patch-cycle owner per product family
Network segmentation	The affected functionality is typically reachable only from the engineering or vendor-maintenance plane	Flat networks turn a single foothold into a fleet-wide event	30 days: confirm the affected devices are not reachable from corporate user VLANs or from the public internet. 90 days: documented segmentation policy, ACL review, source-IP allowlist for engineering access
Account and credential hygiene	Several of the affected product lines ship with default or shared engineering accounts	A stolen or shared engineer account is the simplest path to exploitation	30 days: rotate default passwords, remove unused accounts, enforce MFA on the management plane. 90 days: named-owner accounts per device, recorded in the asset register
Detection and log review	CISA-tagged vulnerabilities in IT-OT stacks rarely have a public SIEM signature on day one	You will not catch exploitation by waiting for a vendor-supplied detection rule	30 days: confirm logs from the affected product are forwarded to your central log store; review for unexpected restarts, configuration changes, and accounts created outside change windows. 90 days: alerting on baseline deviations, runbook for the most likely attack pattern
Incident response and reporting	An exploitation event on an OT system may be NIS2-reportable within 24h (early warning) and 72h (notification)	Deciding what is reportable and when is a legal call, not a technical one	30 days: confirm the IR runbook covers this product family and includes out-of-hours contacts. 90 days: tabletop exercise with the actual affected topology, with the law-firm contact included in the decision chain — legal interpretation requires consultation with a law firm

Perspective of inż. Marcin Białczyk

From operational work with B2B and production environments, the most important sentence in the ICSA-26-211-10 advisory is that the vulnerability is published with affected-product lists and sector tags — meaning the question "are we exposed?" is now a defensible-against-the-audit question, not a technical curiosity. Once CISA publishes an advisory with affected models and firmware versions, any defender can be asked whether they have checked, and the answer that follows is what separates a prepared organisation from a panicked one. The mistake we see in incident-response work is treating ICS advisories as "vendor noise" until an incident happens; the right discipline is to run the same 30-day discipline on every advisory that touches a model in the asset register.

The second lesson is that the operational impact of these advisories is rarely the headline vulnerability — it is the dependency on the vendor's patch schedule. For MZ Automation GmbH in particular, the patch may be staged across product families or require coordination with the OEM that sold the device; the 30-day action is therefore not "patch today" but "confirm the patch path with the vendor, document the compensating control while waiting, and set a hard date to close the gap". In our IT-OT exposure work we treat the patch-schedule gap as a finding on its own, separate from the technical CVE, because it is the dependency that turns a published advisory into a 90-day event in your environment.

The third element is the regulatory dimension for entities in scope of NIS2/KSC. An OT device affected by a CISA advisory is not automatically a NIS2-reportable incident, but a successful exploitation of that device against a NIS2-scope entity is reportable under Article 23, with the early-warning clock starting when credible evidence of significant impact exists. The technical-operational side is what CHORS does — asset inventory confirmation, patch coordination, segmentation review, log analysis, evidence pack, and decision support — but the determination of what is "significant" and what to communicate is a legal and management decision, taken with a law firm. The mistake is to treat reporting as an afterthought; the operational evidence (asset list, firmware version, patch timestamps, segmentation logs) is also the documentation that supports the report.

Frequently asked questions

Is CVE-2026-66720 a critical, high, or medium vulnerability?

CISA's ICS advisories always include a CVSS v3.1 base score; for the affected products the operational impact is typically high because the affected functionality is reachable from the engineering or vendor-maintenance plane and the affected systems sit on OT networks where confidentiality, integrity and availability trade-offs differ from IT. Treat CISA ICS advisories as top-of-queue for the affected product family until patched.

What should we check first in our environment?

Confirm that you have a current inventory of MZ Automation GmbH libiec61850 (IEC 61850 protocol library) with model and firmware version. Cross-reference with the affected-product list in the advisory. For any matching device, capture the network reachability (which VLANs can reach the management plane) and the engineering-account list. Patch where possible; document compensating controls where patching is blocked.

Does this create NIS2/KSC obligations for us?

The vulnerability itself is not reportable; an exploitation event on a NIS2-scope entity is reportable under Article 23. The scope of obligations depends on the entity's status — whether it is classified as essential or important, and whether the affected system is in scope. Legal interpretation requires consultation with a law firm; CHORS supports the technical-operational side, including the evidence pack.

How does CHORS approach this kind of advisory in practice?

With a passive exposure snapshot to confirm whether the affected model is reachable from outside the engineering plane, a documented patch schedule with the vendor, a segmentation review of the affected device's network path, and a log-review pass to confirm there are no signs of prior reconnaissance. None of this is an active exploitation exercise — it is a passive, authorised exposure review that produces an evidence pack the management body can act on.

How CHORS.NET helps

CHORS.NET supports the technical-operational side: passive exposure assessment, configuration verification, evidence packs and NIS2/KSC readiness support. See: Services, About CHORS.NET and Contact.

Boundaries and assumptions

We are not a 24/7 SOC and do not guarantee detection of every incident; our approach is periodic passive exposure assessment and evidence-pack support, not continuous monitoring.
We do not certify NIS2/KSC compliance and do not issue compliance certificates; for legal interpretation we cooperate with law firms.
Results reflect the state at the time of writing; the vendor's patch schedule, exploit availability and sector tagging may change as additional advisories are published.
This material is informational and technical; it is not legal advice.

Precyzyjna wiedza
o ciemnych systemach.