A firmware fix does not close a vulnerability if the operator cannot install it. That gap is now measurable in commercial refrigeration.

Danfoss shipped a fix (R4.3.1) for its AK-SM 800A supervisory controller in 2025, per CISA advisory ICSA-25-140-03. On August 19, 2026, a Shodan query run by Zscaler still found 3,726 Danfoss management interfaces reachable from the public internet, as Zscaler reported. Claroty’s Team82 counted roughly 2,800 exposed interfaces using a different scanner; Zscaler notes the two figures are not a trend line, but the order of magnitude holds.

Copeland shipped its own fix (version 1.13) for the XWEB Pro controller in February 2026, per CISA advisory ICSA-26-057-10. Team82 published 23 vulnerabilities in that product, 21 rated high severity. One flaw lets anyone reaching the management page compute the default administrator password from the date, the hardware address, and a fixed firmware value.

None of this is described as active exploitation in the wild. It is an exposure problem: fixes exist, but cold-chain, food, and pharmaceutical operators often cannot take a maintenance window for a year or more.

For security leaders, the lesson is to stop treating patch availability as risk reduction for OT. Make network reachability the primary control. Pull management interfaces off the public internet, enforce least-privilege access to the controller, segment the OT network, and monitor for manipulation, since these flaws let attackers alter equipment while temperatures still report normal. Programs using IT-style patch SLAs must document compensating controls when OT patch timelines stretch past a year.