CISA published five ICS/medical advisories on Oct 15. ICSA-26-288-02: Guangzhou Juan IoT EseeCloud app (4.9.6 and earlier) and firmware (4.9.86.0 and earlier) have three flaws, including a hard-coded credential that lets an attacker log in to devices (CVE-2026-107617, CVSS 9.8); the vendor didn't respond to CISA, so there is no fix. ICSMA-26-288-02: J4Care dcm4chee-arc-light 5.35.1 has six CVEs, including missing authorization that lets an unauthenticated attacker delete stored medical images (CVSS 9.1), inject forged studies, reassign patient records or cause a DoS; fixed in 5.35.2. ICSA-26-288-01: Eclipse Milo 0.6.0–1.1.4 has five bugs, including a Call-service batching flaw that lets an anonymous client run a denied method by batching it with an allowed one (CVE-2026-62927); fixed in 1.1.5, with no 0.6.x fix. Also out: Thermo Fisher Torrent Suite path traversal (fixed in 5.22) and CISA's own Malcolm. None is reported as exploited.