SEV3 — ElevatedCLOSEDCyberONGOINGUnverified49d ago

Critical ScadaBR Vulnerabilities Detected Across Multiple US Metro Areas

High-severity cybersecurity vulnerabilities have been identified in ScadaBR systems across five major US metropolitan areas including Dallas-Fort Worth and Denver. ScadaBR is industrial control software commonly used for building automation and infrastructure management in commercial facilities. Operations leaders should coordinate with IT security teams to assess potential impacts on facility systems supporting contact center operations.

Impact Summary

Domain

Cyber

Region

Colorado Springs

Opened By

watchkeeper

May 23, 2026, 01:00 PM UTC

Validated By

auto

May 23, 2026, 01:00 PM UTC

Event Cluster

41 events

OVIX Score

10.0

Closed

master(master-relevance-cleanup)

Jun 2, 2026, 03:33 PM UTC

Timeline13

⚠

Incident openedby watchkeeperMay 23, 2026, 01:00 PM UTC

Declared from 5 signals. OVIX 10. News 0. BPO 3. LLM-confirmed.

✓

Severity validatedby autoMay 23, 2026, 01:00 PM UTC

Auto-validated: SEV3 per policy.

✎

Note addedby watchkeeperMay 24, 2026, 01:30 AM UTC

Merged new cluster (7 signals, OVIX 10) — same domain/region, >=3 shared title words, active <24h.

✎

Note addedby watchkeeperMay 24, 2026, 02:00 AM UTC

Merged new cluster (7 signals, OVIX 10) — same domain/region, >=3 shared title words, active <24h.

↻

Revalidatedby watchkeeperMay 25, 2026, 01:00 PM UTC

Revalidated: no new activity. Next reval in 48h.

✎

Note addedby watchkeeperMay 25, 2026, 05:00 PM UTC

Merged new cluster (5 signals, OVIX 10) — same domain/region, >=3 shared title words, active <24h.

✎

Note addedby watchkeeperMay 27, 2026, 04:30 AM UTC

Merged new cluster (6 signals, OVIX 10) — same domain/region, >=3 shared title words, active <24h.

✎

Note addedby watchkeeperMay 27, 2026, 10:30 AM UTC

Merged new cluster (7 signals, OVIX 10) — same domain/region, >=3 shared title words, active <24h.

↻

Revalidatedby watchkeeperMay 27, 2026, 01:30 PM UTC

Revalidated: no new activity. Next reval in 48h.

↻

Revalidatedby watchkeeperMay 29, 2026, 01:31 PM UTC

Revalidated: no new activity. Next reval in 48h.

✎

Note addedby watchkeeperMay 31, 2026, 02:00 PM UTC

Flagged persistent: >7d of continuous activity. Switching to weekly revalidation.

↻

Revalidatedby watchkeeperMay 31, 2026, 02:00 PM UTC

Revalidated: 4 new related signal(s). Next reval in 168h.

✖

Incident closedby masterJun 2, 2026, 03:33 PM UTC

Bulk-closed in master-relevance-cleanup (2026-06-02): rebuilding incident board clean per INCIDENT-RELEVANCE-SPEC. Most open incidents were non-WFM cyber CVE noise or No-BPO-Impact weather. Fixed Watchkeeper/scout will re-declare only genuinely relevant incidents.

Evidence / Why this?

Traced to source — read-only

Evidence is not yet available for this incident. Older incidents predate the traceability layer; newly declared incidents will show why they were declared, why their severity was set, geo provenance, and their sources here.

Related Signals20

Affected Regions

Colorado SpringsAlbuquerqueDfwDenverDes Moines