Critical Airleader Flaw Exposes Systems to Remote Code Execution Attacks

A critical security flaw in Airleader Master software has come to light, putting industrial control systems (ICS) at grave risk of remote code execution (RCE) attacks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed the vulnerability on February 12, 2026, highlighting its potential to disrupt operations in vital sectors.

Tracked as CVE-2026-1358, the issue affects Airleader Master versions up to and including 6.381. It earns a maximum CVSS v3.1 score of 9.8 due to its critical severity; attackers need no privileges or user interaction, and it has a low attack complexity with widespread impact.

The root cause lies in an unrestricted upload of files with dangerous types, where the software fails to validate uploads properly.

This lets threat actors upload and execute malicious files directly on vulnerable systems, seizing full control.

Such a compromise could wreak havoc across chemical plants, manufacturing sites, energy grids, food production, healthcare facilities, transportation hubs, and water treatment plants globally.

These ICS environments often run legacy setups with internet exposure, amplifying the threat.

Security researcher Angel Lomeli from SySS GmbH discovered the flaw and responsibly reported it to CISA, enabling coordinated disclosure.

No active exploitation reports exist yet, but the high score demands urgency.

CVE ID	CVSS Score	Vulnerability Type	Affected Versions
CVE-2026-1358	9.8 (Critical)	Unrestricted Upload of File with Dangerous Type	Airleader Master ≤6.381

Organizations must act fast to safeguard systems. CISA urges isolating control devices from the internet, placing them behind firewalls segregated from corporate networks, and using updated VPNs for any remote access.

Conduct risk assessments and impact analyses before changes to avoid disruptions.

Defense-in-depth remains key: segment networks, enforce strict access controls, and monitor for anomalies continuously.

Review CISA’s ICS security best practices and intrusion detection guidance. If suspicious activity appears, trigger incident response plans and report to CISA at https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-10 for threat correlation.

This vulnerability underscores ICS fragility in critical infrastructure. Patch to Airleader Master versions beyond 6.381 where available, or apply vendor fixes promptly. Immediate steps prevent potential chaos in essential services.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google

The post Critical Airleader Flaw Exposes Systems to Remote Code Execution Attacks appeared first on Cyber Security News.