Wärtsilä builds engines and automation for ships, and one of the software packages it puts on board shipped with its cryptographic keys written into the code. CISA published the advisory on September 15. Two components of FOS-Onboard version 5.07.0923.01 carry hardcoded keys, and between them CISA says successful exploitation could let an attacker deliver an unauthorized update, execute code, or extract credentials to impersonate a privileged client.
One key, every installation
A hardcoded cryptographic key is what it sounds like: a secret fixed in the software itself rather than generated per install. Anyone who extracts it from one copy holds the secret for every copy. That is why CWE-321, the weakness class both flaws fall under, tends to produce high scores regardless of how obscure the product is.
The more serious of the two, CVE-2026-78225, sits in the deployer-ng Update Controller, the component responsible for software updates. It is a hardcoded server key, rated 9.0 critical under CVSS 3.1 and 9.5 under CVSS 4.0. Subverting the thing that authorizes updates is about as deep as a foothold gets, because a machine that accepts your update accepts your code.
The second, CVE-2026-81855, is a hardcoded client authentication key in the product's robot testing framework component, rated 9.1 under CVSS 3.1 and 9.3 under CVSS 4.0. Test harnesses are a recurring soft spot in shipped products, built to make automated access easy and not always stripped before release. Both flaws were reported by Cydome Security Ltd, which took them to Wärtsilä and to CISA.
Wärtsilä says the setup matters
The vendor's position, recorded in the advisory, is that the vulnerabilities are not exploitable when the product is installed as recommended. That is a meaningful caveat and worth reading precisely: it is a claim about deployment, not a dispute about the keys. An operator who cannot confirm that their installation follows Wärtsilä's guidance should not treat it as cover. CISA reports no known public exploitation of either flaw at this time.
CISA files the affected equipment under transportation systems, deployed worldwide, with Wärtsilä headquartered in Finland. Shipboard technology keeps turning up in this position, reachable in principle and awkward to service in practice, from satellite routers with a public exploit and no patch to the transponder flaws CISA flagged in August. A vessel at sea is not a datacentre, and the maintenance window may be the next port call.
Getting the patch means a phone call
Wärtsilä has developed a security patch, but it is not a download. Operators have to contact the company through its ICS patch deployment page to obtain and install it, so fleet owners should start that conversation rather than wait for a notification to arrive. In the meantime the standard control system hygiene applies, and matters more than usual here: keep the network segment this software runs on off the internet, behind a firewall, and separated from business systems.
The full advisory, including the affected version and the vendor contact route, is published by CISA as ICSA-26-258-02.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.