Overnight on 12 and 13 October 2026, somebody turned the fridges up. More than 500 French shops and supermarkets found their refrigeration units had been remotely commanded into a forced defrost cycle, with cabinet temperatures reported as high as 50°C and one store reporting 80°C. Intermarché and Netto counted hundreds of affected stores, Coopérative U more than 100, Carrefour around 80, with Monoprix and E.Leclerc also hit. Intermarché’s chief executive put the national loss at tens of millions of euros in a single day. The Paris prosecutor opened a cybercrime investigation.
The systems involved were made by Danfoss, the Danish refrigeration and HVAC manufacturer, with the AK-SM and AK-SC product series named in reporting. Danfoss said the affected units were legacy products running outdated firmware, and that it had previously advised supermarkets to update them.
That last sentence is the one worth stopping on, because it is true, and because it is also where the story gets uncomfortable. Danfoss did advise customers to update. So did the United States government, in a machine-readable advisory published seventeen months ago. And in the field that automated tooling actually reads, that advisory said there was no vendor fix.
TL;DR
- CISA published ICSA-25-140-03 on 20 May 2025 (revised 26 August 2025) covering the Danfoss AK-SM 8xxA Series, the system manager that coordinates supermarket refrigeration. Sector: Commercial Facilities. Deployment: Worldwide.
- It describes a remote authentication bypass caused by datetime-based password generation (CVE-2025-41450, CVSS 8.2), OS command injection leading to remote code execution (CVE-2025-41451), and a configuration-injection denial of service (CVE-2025-41452).
- Danfoss shipped firmware R4.2 and R4.3.1 to fix them. In the advisory’s CSAF JSON, those releases are filed under
category: "mitigation", which the CSAF 2.0 specification defines as something that does not resolve the vulnerability. Not one remediation in the file carriesvendor_fix. - We parsed every CISA ICS advisory published in 2025 and 2026 to date: 932 files. 360 contain no
vendor_fixremediation at all, and 233 of those 360 describe an update, upgrade or fixed version in their own prose. - 406 of the 426 advisories in the 2026 set tell you to minimise network exposure and keep the device off the internet. 410 of 426 are deployed worldwide. For a product whose entire commercial proposition is a remote web console, that is not an instruction anyone can follow.
- Across all 932 advisories, the string “AK-SC” appears zero times. One of the two product families named in the French attack has never been the subject of an advisory at all.
The advisory that already existed
The Danfoss AK-SM 800A is not an obscure box. It is the system manager that sits above the individual refrigeration controllers in a store, aggregating field devices and giving staff and contractors a browser interface to monitor circuits, set temperature thresholds, review alarms, adjust schedules and, yes, coordinate defrost cycles. Danfoss sells remote administration as the point: engineers troubleshoot without driving to every site.
Claroty’s Team82 took the platform apart and published the full technical write-up on 9 August 2026, under the title “Freeze the Controller, Defrost the Food”. The headline finding is a hidden authentication path the researchers call “code-of-the-day”: rather than checking the configured administrator password, the application accepts a request containing a generated code derived from the device’s current date. Reproduce the algorithm and you are in. From there, a command-injection flaw in the alarm-to-mail configuration fields yields remote code execution.
Team82 also asked the obvious question before touching the firmware: can an attacker reach these at all? Searching Shodan and Censys for the Danfoss StoreView management interface signature returned 2,765 exposed devices on the public internet.
We want to be careful here. No root cause for the French incident has been published, no attribution has been made, and we are not claiming these CVEs were the route in. What we can say precisely is what the public record contained before Monday, and what shape it was in.
The field that says there is no fix
CISA publishes its ICS advisories twice: as a web page for humans, and as CSAF 2.0 JSON in a public GitHub repository for machines. The JSON exists so that vulnerability management platforms, asset inventories and SBOM tooling can ingest advisories without screen-scraping. That is the entire point of the format.
In CSAF, each remediation carries a category from a closed set of five values. The specification is unambiguous about two of them:
The value
mitigationindicates that the remediation contains information about a configuration or deployment scenario that helps to reduce the risk of the vulnerability but that does not resolve the vulnerability on the affected product.The value
vendor_fixindicates that the remediation contains information about an official fix that is issued by the original author of the affected product. Unless otherwise noted, it is assumed that this fix fully resolves the vulnerability.
Now open 2025/icsa-25-140-03.json. Every one of the three CVEs carries the same remediation text: “Danfoss created release R4.2 to address CVE-2025-41450 and release R4.3.1 to address CVE-2025-41451 and CVE-2025-41452. Users can obtain and install the latest version by following the AK-SM 800A Software Upgrade Process.” That is an official fix issued by the original author, described in plain words.
Its category is mitigation. There is no vendor_fix anywhere in the file. Any tool that triages on the structured field, which is the only field a tool can triage on at scale, sees an advisory with no available patch and a recommendation to adjust your network. It never raises a patch ticket, because according to the data there is nothing to patch to.
What 932 advisories look like
We pulled the full CISA CSAF repository tree and downloaded every advisory JSON in the 2025 and 2026 directories, then counted remediation categories per advisory. All figures below were measured on 13 October 2026; the 2026 set runs to ICSA-26-281-03, published 8 October.
| Measurement | 2025 | 2026 to date | Combined |
|---|---|---|---|
| Advisories parsed | 506 | 426 | 932 |
With no vendor_fix remediation |
197 (39%) | 163 (38%) | 360 |
| Of those, prose describes an update or fixed version | 124 | 109 | 233 |
With at least one no_fix_planned |
46 | 21 | 67 |
With at least one none_available |
29 | 16 | 45 |
So the rate is stable across two years, which rules out a one-off generator bug. Roughly four in ten CISA ICS advisories carry no machine-readable vendor fix, and roughly two in three of those are describing a vendor fix in the text immediately beside the field.
We have measured this dataset family once before, from a different angle. In timing 6,119 package-ecosystem advisories we found 1,826 that landed more than a month after the fix was public. That was a question about when an advisory arrives. This is a question about whether, once it has arrived, it says the right thing.
Cut the same data by vendor and the cause becomes visible. Siemens, which authors and publishes its own CSAF documents, accounts for 218 advisories in the set and only 29 of them lack a vendor_fix. Rockwell Automation accounts for 82 and 50 of them lack one. Schneider Electric: 14 of 83. Mitsubishi Electric: 10 of 23. The difference is not whether those vendors ship patches. It is who filled in the form.
There is a structural reason. The human-readable CISA advisory puts remediation guidance under a section heading that reads “MITIGATIONS”, regardless of whether the content is a firmware release or a firewall rule. When that prose is converted into CSAF, the section name appears to come along with it. The category is inherited from a template, not chosen as an assertion about the world. That is a pipeline defect, and it is quietly poisoning a dataset that security teams are being told to automate against.
The advice nobody can take
Of the 426 advisories published in 2026, 406 carry the boilerplate instruction to minimise network exposure for all control system devices, and 370 specifically say to ensure they are not accessible from the internet. Meanwhile 410 of 426 list their deployment as “Worldwide”.
For a refrigeration system manager, “do not put it on the internet” is not a mitigation. It is a request to stop using the product as designed. Danfoss sells cloud-connected food retail services on top of these controllers; Claroty found 2,765 of them with the management console facing the public internet, which is exactly how a contractor servicing 300 stores would set them up. When the only machine-readable remediation is advice that contradicts the product’s architecture, the advisory has told the operator nothing actionable at all.
We also checked two smaller things, both first-hand. Across all 932 advisories, “Danfoss” appears in exactly one file, and “AK-SC” appears in none. Searching the full CISA CSAF repository, covering 3,961 advisories back to 2010, returns two Danfoss hits in total: the 2025 one, and a 2015 solar inverter advisory. The AK-SC series, one of the two product families named in this week’s attack, has no advisory history whatsoever. An inventory built from advisory feeds would not have known the device existed.
And the detail that made us wince. The advisory’s remediation carries a download link, and both the R4.2 reference and the R4.3.1 reference point at the same URL: a file named SM800A-4.2.4.spk. We fetched its headers on 13 October 2026. It returns HTTP 200, 28,985,282 bytes, last modified 13 March 2025. The advisory that told supermarket operators to upgrade to R4.3.1 in order to close the remote code execution hole links them to a 4.2.4 package.
What to actually do about it
If you run, integrate with, or are responsible for anything in the operational technology layer, three things follow directly from this data.
Stop triaging on the category field alone. If your vulnerability pipeline ingests CSAF and routes on remediations[].category, roughly 38% of CISA ICS advisories will arrive looking unfixable. Add a second pass that greps the details string for version and release language and flags the contradiction for a human. It is about twenty lines of code and it would have surfaced the Danfoss advisory as a patch ticket in May 2025.
Treat advisory silence as unknown, not safe. Zero advisories for a product family means nobody has looked, or nobody published. It does not mean the firmware is clean. Build your asset inventory from what is physically deployed and what the vendor’s own disclosure page says, then map advisories onto it, never the other way round.
Audit remote management surfaces as a class. The controllers in this story were not breached through an exotic supply chain. They were web applications on the public internet running firmware from before March 2025. Every organisation has a category of device that nobody put in the patch calendar because it is not a server: building management, access control, EV chargers, cameras, point of sale. In the 2026 set alone, 84 advisories name the Commercial Facilities sector. This is the same blind spot we wrote about in firmware supply chains, arriving from the opposite direction: there, the device was missing from your inventory; here, the fix is missing from your feed.
This is the kind of work we do at REPTILEHAUS. We build the integration layer between the systems that generate security data and the systems that act on it, and we audit the places where those two disagree. If your vulnerability tooling is making decisions from a field that nobody has checked, or you have a fleet of connected devices with no owner and no patch clock, get in touch. We would rather look at it now than read about it in Bloomberg.
Method and caveats
All counts were produced on 13 October 2026 by downloading the cisagov/CSAF repository tree and parsing every advisory JSON in the csaf_files/OT/white/2025 and 2026 directories: 506 and 426 files respectively, 932 total, with no download failures. “No vendor_fix” means no remediation object in the document carries that category. “Prose describes an update” means the concatenated details fields of the non-fix remediations match a case-insensitive pattern for update, upgrade, patch, release, firmware or fixed version, which is a heuristic and will include a small number of false positives. The all-years Danfoss and AK-SC figures rely on GitHub code search over the repository, which indexes public content but is not guaranteed exhaustive; the 2025 and 2026 figures are from local greps of files we downloaded. Finally, nobody has published a root cause for the French incident, and nothing here should be read as establishing one.
📷 Photo by Sebastian Frederik Jacobsen on Unsplash
