Patch Now: Attackers Target OT Networks via Critical RCE Flaw

Unit 42 has observed active exploitation of a critical RCE in Erlang/OTP (CVE-2025-32433, CVSS 10.0) that allows unauthenticated SSH protocol messages (post-authentication codes) to trigger remote command execution. Since May 1 attackers have used the flaw to deliver reverse shells and other payloads against OT and critical-infrastructure networks across multiple countries and industries (notably healthcare, agriculture, media, and high technology), with 3,376 detection signatures observed globally and ~70% originating from OT firewalls; vendors have released patches (OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20) and mitigations include IPS signature updates, restricting SSH access, or disabling SSH until patched.