Critical Airleader Flaw Allows Remote Code Execution Attacks

Concerns are mounting across multiple critical infrastructure sectors following the recent disclosure of a vulnerability in an industrial control system (ICS) monitoring solution.

Published by CISA under advisory code ICSA-26-043-10, the flaw has been assigned CVE-2026-1358 and carries a CVSS v3 score of 9.8, indicating critical severity.

According to the advisory released on February 12, 2026, the vulnerability affects all versions of Airleader Master up to 6.381. It could allow unauthenticated attackers to execute arbitrary code on target systems remotely.

The issue arises from an unrestricted file upload weakness that allows the upload of dangerous file types that can be executed on the device.

The vulnerability resides in the file handling component of Airleader Master, developed by Germany-based Airleader GmbH.

Successful exploitation enables adversaries to gain control over vulnerable servers or network-connected systems.

Potentially disrupting operations in energy, chemical, healthcare, food and agriculture, manufacturing, transportation, and water management sectors.

CISA notes that while there are no known public exploits targeting this flaw yet, the potential for damage is significant given the global use of Airleader Master for industrial system optimization and monitoring.

CISA urges system administrators and operators of critical infrastructure to take immediate steps to reduce exposure.

Restrict network access by ensuring control systems are not available from the internet. Segment ICS networks and place them behind properly configured firewalls.

Use VPNs for remote access, but ensure they are fully updated and hardened. Conduct impact assessments and risk analyses before implementing new defensive measures.

CISA also encourages following its Industrial Control System (ICS) cybersecurity best practices.

Detailed in guidance documents like Improving ICS Cybersecurity with Defense-in-Depth Strategies and ICS-TIP-12-146-01B: Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations detecting suspicious activity associated with this vulnerability should report it to CISA for coordinated analysis and response.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.