CISA ICS Advisory: ANDRITZ HIPASE-250 and 250 SCALA

On August 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) released an ICS advisory detailing vulnerabilities in ANDRITZ HIPASE-250 and HIPASE-250 SCALA industrial control systems.

Unauthorized data access and workstation compromise

The advisory states that successful exploitation of the vulnerabilities could allow an attacker to read data from the device or gain access to affected workstations. CISA has not stated whether the flaws have been exploited in the wild.

Affected products

The advisory concerns ANDRITZ HIPASE-250 and HIPASE-250 SCALA. It does not list specific version numbers or build details that require patching. No other products are named.

What to do

• Determine whether HIPASE-250 or HIPASE-250 SCALA devices are present in your operational technology environment.
• Consult ANDRITZ directly for available firmware updates or vendor-specific mitigations.
• Implement the compensating controls listed in the CISA advisory, including network segmentation that prevents unauthorized access to the affected devices.
• Monitor ANDRITZ’s official support channels for any future patches or additional guidance.
• Review and, where necessary, restrict workstation access rights for systems that interact with these HIPASE units.

Organizations responsible for critical infrastructure should treat these industrial control system vulnerabilities as high priority for remediation planning.