DACH OT Security Week 43/2026: BeyondTrust zero-day and Siemens PLC flaws

OT threat level in the DACH region is high for 15–23 October 2026. A BeyondTrust Remote Support zero-day (CVE-2026-102764) was exploited before disclosure, with activity attributed to ARMORY CASTLE, while Siemens SIMATIC S7-1500 and ET 200SP web servers carry vulnerabilities that let attackers run PLC operations with the logged-in user's rights.

• BeyondTrust CVE-2026-102764 exploited since 29 August; disclosed 15 October
• Siemens S7-1500 and ET 200SP flaws in ICSA-26-295-14; fixes pending
• Siemens Software Center abused to deliver ClickFix malware via MSI
• SafePay advisory AA26-293A urges MFA on all VPN accounts