High severity · published Aug 4, 2026
CVE-2026-60007
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures,…
7.4
CVSS
0.6%
EPSS
No
On KEV
Description
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Eclipse Milo · Eclipse Foundation
0.6.0 through 1.1.4 · source: vendor
MI
Milo · Eclipse
0.6.0 before 1.1.5 · source: NVD
In the news
VulnerabilityHigh
Eclipse Foundation Eclipse Milo
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.
The following versions of Eclipse Foundation Eclipse Milo are affected:
Eclipse Milo >=0.6.0|<=1.1.4 (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007)
Eclipse Milo >=1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387)
CVSS
Vendor
Equipment
v3 8.2
Eclipse Foundation
Eclipse Milo
5 Vulnerabilities
Incorrect Authorization, Missing Release of Memory after Effective Lifetime, Missing Authorization, Observable Response Discrepancy, Missing Release of Resource after Effective Lifetime
Background
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Belgium
Vulnerabilities
Expand All +
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.
Read More
1 Affected Product
Eclipse Foundation Eclipse Milo: >=1.0.0|<=1.1.4
Product Status: known_affected
Remediations...
Oct 15, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-60007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-60007
Patch
https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183
Issue Tracking
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598
More from Eclipse Milo
8.2
CVE-2026-58080
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`
7.5
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote…
7.5
CVE-2026-62927
In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous…
7.5
CVE-2026-61387
In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation…
6.5
CVE-2026-63248
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization