Horner Automation Cscape and XL4, XL7 PLC

Horner Automation's Cscape engineering software and XL4/XL7 PLCs used in critical manufacturing have a weak password requirements vulnerability (CVE-2026-6284, CVSS 9.1) that allows network-accessible attackers to brute force credentials with no rate limiting or complexity enforcement. Affected versions include Cscape v10.0, XL7 PLC v15.60, and XL4 PLC v16.32.0. Developers and engineers integrating or managing industrial control systems should apply patches or mitigations immediately, as successful exploitation could grant unauthorized access to operational technology environments.