CISA 2026-06-25

Yokogawa FAST/TOOLS and CI Server

CVE-2026-11833

Machine-generated analysis · WAYSCloud LLM

The advisory states that affected versions of Yokogawa FAST/TOOLS and CI Server may transmit CI Server settings in cleartext, potentially enabling further attacks.

Context

The advisory covers Yokogawa FAST/TOOLS and Collaborative Information Server (CI Server), which are used in critical manufacturing, energy, and food and agriculture sectors. The vulnerability involves cleartext transmission of sensitive information, specifically CI Server settings, via the web server. Successful exploitation could allow an attacker to obtain configuration data that may aid in subsequent attacks. The CVSS score is rated 7.5 (v3) and 8.2 (v4), both classified as HIGH.

Operator considerations

- Patch: Yokogawa advises updating FAST/TOOLS to R10.04 and applying patch R10.04 SP4, and updating CI Server to R1.05.
- Check: Verify deployment of FAST/TOOLS versions R9.01 to R10.04 and CI Server versions R1.01 to R1.04.
- Log: Monitor web server responses for unexpected transmission of configuration data if updates are not yet applied.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability may return a response containing the CI Server setting information.

The following versions of Yokogawa FAST/TOOLS and CI Server are affected:

FAST/TOOLS >=R9.01|=R1.01|=R9.01|=R1.01|

Read the full advisory on CISA →