CISA warns of MongoDB flaws in ABB Ability Zenon IIoT services

By Atlas Watchline Staff · Regulatory · August 6, 2026

CISA has issued an ICS advisory on ABB Ability Zenon, warning that bundled MongoDB 4.2 software in IIoT services could expose control systems to multiple vulnerabilities.

CISA says ABB Ability Zenon deployments that use bundled MongoDB 4.2 in IIoT services may be exposed to multiple vulnerabilities, with ABB advising users to replace the database or remove the services.

CISA published an industrial control systems advisory for ABB Ability Zenon on Aug. 6, 2026, and said the issue stems from IIoT services that bundle MongoDB 4.2. The agency said successful exploitation of the listed flaws could let an attacker bypass security, crash systems, execute unauthorized actions or compromise data.

CISA said ABB Ability Zenon is used across multiple critical infrastructure sectors. Those sectors include Chemical, Communications, Critical Manufacturing, Dams, Energy, Healthcare and Public Health, Information Technology, and Water and Wastewater. CISA listed the deployment scope as worldwide.

CISA identified ABB Ability Zenon with IIoT services using MongoDB as the affected product version, listed in the advisory as vers:all/*. The advisory names ABB as the vendor and says the company is headquartered in Switzerland. CISA said ABB PSIRT had reported the vulnerabilities to the agency.

The advisory lists a series of CVEs tied to the bundled MongoDB 4.2 context, including CVE-2025-14847, CVE-2020-7928, CVE-2020-7921, CVE-2020-7925, CVE-2020-7929, CVE-2020-7923, CVE-2021-20330, CVE-2021-32036, CVE-2021-32040, CVE-2021-20333, CVE-2020-7924, CVE-2021-20328 and CVE-2021-20334. CISA said the issues include weaknesses such as improper handling of length parameter inconsistency, improper neutralization of a null byte or NUL character, out-of-bounds write, improper certificate validation and execution with unnecessary privileges.

In the advisory’s summary table, the scores range from 5.3 to 7.8 under CVSS v3.1, with CVE-2025-14847 also carrying a CVSS v4.0 score of 8.7. CISA said no known public exploitation specifically targeting these vulnerabilities had been reported at the time of publication.

ABB recommends replacing the bundled MongoDB with a supported and patched version if IIoT services are required. If IIoT services are not needed, ABB says they can be removed with the Control Panel uninstaller. The advisory also points users to the zenon online help section for installing and using a user-provided MongoDB database.

CISA’s general guidance in the advisory says operators should minimize network exposure for control system devices, isolate control system networks behind firewalls, use VPNs for remote access and keep those VPNs updated. The agency also advises impact analysis and risk assessment before deploying defensive measures.

The advisory was first released on July 30, 2026, and CISA said it republished ABB PSIRT advisory 9AKK108472A9037 on Aug. 6. CISA also linked to the ABB PSIRT PDF advisory and CSAF version for further technical details.

Sources

• CISA advisory page
• ABB PSIRT PDF advisory
• ABB PSIRT CSAF advisory

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.