TL;DR Moxa disclosed two Moxa MGate vulnerabilities on October 2, 2026. The worse flaw, CVE-2026-86325, scores 9.4 on CVSS 4.0 and lets a read-only user corrupt device memory. The second, CVE-2026-86326, lets a privileged attacker install tampered firmware. Why It Matters MGate protocol gateways link serial and Ethernet devices in industrial networks. According to a 2016 CISA advisory, Moxa estimates these units run across energy, water, manufacturing, and government sectors.