CISA Releases Critical Advisory on Physical Access Control System Vulnerabilities

A summary of official ICS advisories released on October 1, 2026 by CISA highlights critical security flaws discovered in Armatura One physical-access control systems that could expose infrastructure to unauthorized access. The advisory compiles technical findings, identifies affected product versions, and provides vendor remediation guidance based on CISA's most recent threat analysis. Organizations deploying these systems are encouraged to review the guidance and apply necessary security updates to mitigate risks.

The October 1, 2026 advisory batch from CISA identified multiple critical weaknesses across infrastructure control systems. The Armatura One physical access platform faces several compounding risks: a known deserialization vulnerability from Apache ActiveMQ with a 9.8 severity rating, alongside inadequate credential management practices including hardcoded encryption keys and database administrator passwords embedded in system logs. These flaws collectively create pathways for attackers to gain elevated system privileges or manipulate access control operations.

The advisory also flagged separate vulnerabilities in EV charging infrastructure managed by the Monta platform, where unauthenticated communication endpoints and weak session management could allow attackers to impersonate legitimate charging stations or execute unauthorized commands. Both vendors have released patches, though CISA has not yet documented active exploitation attempts against either system in the wild.