SEV3 — ElevatedCLOSEDCyber✓ Corroborated · 3 sources21d ago

Critical ICS/SCADA Vulnerabilities Flagged in Colorado Springs — Operations Footprint at Risk

Two severity-10 CVE alerts have been triggered for Labcenter Proteus 9 and OpenPLC v3 in Colorado Springs, both classified as critical ICS/SCADA vulnerabilities. Colorado Springs hosts approximately 66,000 combined contact-center, back-office, and knowledge-worker seats, meaning exploitation of industrial control or programmable logic systems could affect building infrastructure, power management, or access controls at operational sites. While no confirming news coverage has surfaced yet, the pattern mirrors recently declared incidents in Omaha and Tulsa and warrants active monitoring and coordination with facilities and IT security teams.

Impact Summary

Two severity-10 CVE alerts have been triggered for Labcenter Proteus 9 and OpenPLC v3 in Colorado Springs, both classified as critical ICS/SCADA vulnerabilities. Colorado Springs hosts approximately 66,000 combined contact-center, back-office, and knowledge-worker seats, meaning exploitation of industrial control or programmable logic systems could affect building infrastructure, power management, or access controls at operational sites. While no confirming news coverage has surfaced yet, the pattern mirrors recently declared incidents in Omaha and Tulsa and warrants active monitoring and coordination with facilities and IT security teams.

Domain
Cyber
Region
Colorado Springs, US, US
Opened By
watchkeeper
Jul 11, 2026, 05:00 PM UTC
Validated By
auto
Jul 11, 2026, 05:00 PM UTC
Event Cluster
2 events
OVIX Score
10.0
Closed
watchkeeper-auto(resolved)
Jul 13, 2026, 05:00 AM UTC

Timeline4

Incident openedby watchkeeperJul 11, 2026, 05:00 PM UTC
Declared from 2 signals. OVIX 10. News 0. BPO 1. LLM-confirmed.
Severity validatedby autoJul 11, 2026, 05:00 PM UTC
Auto-validated: SEV3 per policy.
Note addedby watchkeeperJul 11, 2026, 05:00 PM UTC
External corroboration: corroborated (3 sources via Exa). windowsnews.ai, cyfar.ca, assurantcyber.com
Incident closedby watchkeeperJul 13, 2026, 05:00 AM UTC
Auto-closed: no new material events within 36h for this incident.

Evidence / Why this?

Traced to source — read-onlyUpdated Jul 11, 05:00 PM UTC
Why declareddeclareHybrid
Incident declaration (deterministic floor + LLM relevance gate)v1
DECLARE when deterministicFloor AND (llm.declare OR acuteWeatherFloor) AND NOT aggregateTitle, and no open same-domain incident merges it. deterministicFloor = maxSeverity>=8 AND (newsScore>=1 OR bpoScore>=1 OR acuteWeatherFloor). acuteWeatherFloor = maxSeverity>=9 AND any signal is an acute severe-weather WARNING (tornado/severe-thunderstorm/flash-flood) — overrides the LLM footprint-based suppression. aggregateTitle (grab-bag "Multiple/Several/Various…") is refused (agents-019 §D). Asset-class deny (military/war-zone, WFM-37) suppresses earlier. cyberFloor disabled (agents-009 hotfix).
domain
cyber
regions
["Colorado Springs"]
bpo score
1
news score
0
llm declare
yes
max severity
10
signal count
2
llm rationale
Declaring true: Colorado Springs carries a meaningful operations footprint (~66K seats), the vulnerability class (ICS/SCADA) directly threatens site infrastructure, severity is maximal (10.0 x2), and this is not materially duplicative of the Omaha or Tulsa open incidents — it is a distinct geographic instance of the same vulnerability pattern.
aggregate title
no
high confidence
no
acute weather floor
no
deterministic floor
yes
model claude-sonnet-4-6 · prompt watchkeeper-declare-2026-06
Why SEV3SEV3score 3Deterministic
Incident severity level (SEV1–SEV4) at declarationv1
Base: SEV2 if sev>=9 AND news>=2 AND bpo>=1; else SEV3 if sev>=8 AND (news>=1 OR bpo>=1); else SEV4. Acute severe-weather (agents-028): if sev>=9 floor to SEV3 (SEV2→SEV3); minor/transient watches+advisories drop SEV2/SEV3→SEV4. Single-event cap: any SEV2 caps to SEV3 absent sustained multi-day BPO-region corroboration (SEV2 promotion is human-gated via revalidation). score = numeric SEV (1=most severe … 4); SEV3/SEV4 auto-validate, SEV1/SEV2 require human validation.
domain
cyber
bpo score
1
news score
0
persistent
no
max severity
10
auto validated
yes
acute weather floor
no
Geo Provenance
Tiercentroid
Sourcegeo_density
Deterministic

Related Signals14

[Colorado Springs] cyber 10.0 — Hitachi Energy e-mesh EMSsentinel19d ago[Colorado Springs] cyber 10.0 — Hitachi Energy e-mesh EMSsentinel20d ago[Colorado Springs] cyber 10.0 — Hitachi Energy PROMOD Vsentinel20d ago[Colorado Springs] cyber 10.0 — Digi International PortServer TS, Digi One SP IAsentinel20d ago[Colorado Springs] cyber 10.0 — OpenPLC v3sentinel20d ago[Colorado Springs] cyber 10.0 — Hydro-Québec Le Circuit Electrique charging station backendsentinel20d ago[Colorado Springs] cyber 10.0 — OpenPLC v3sentinel20d ago[Colorado Springs] cyber 10.0 — Hydro-Québec Le Circuit Electrique charging station backendsentinel20d ago[Colorado Springs] cyber 10.0 — Digi International PortServer TS, Digi One SP IAsentinel20d ago[Colorado Springs] cyber 10.0 — Digi International PortServer TS, Digi One SP IAsentinel20d ago[Colorado Springs] cyber 10.0 — OpenPLC v3sentinel21d ago[Colorado Springs] cyber 10.0 — Hitachi Energy e-mesh EMSsentinel21d ago[Colorado Springs] cyber 10.0 — Labcenter Proteus 9sentinel21d ago[Colorado Springs] cyber 10.0 — OpenPLC v3sentinel21d ago

External Corroboration

✓ Corroborated · 3 sourcesChecked Jul 11, 2026, 05:00 PM UTC
Critical SNMP Vulnerability in Schneider Electric Easergy Relays Opens Door to Grid Disruption - Windows Newswindowsnews.aiJul 9, 2026, 04:32 PM UTCCyber Centre Daily Advisory Digest — 2026-07-06 (8 advisories) · cyfar.cacyfar.caJul 6, 2026, 04:10 PM UTCSchneider Electric PowerChute Serial Shutdown - ASSURANT™assurantcyber.comJul 9, 2026, 12:00 PM UTC

Affected Regions

Colorado Springs