The Fix Has Been Out for a Year. The Controller Is Still Exposed.
Zscaler, Thursday, August 20th, 2026
Zscaler finds thousands of refrigeration controllers still unpatched months after fixes shipped, because outages spoil product.
Zscaler examines the gap between when OT vendors fix vulnerabilities and when operators can actually apply the patches.
In food, pharmaceutical and cold-chain sites the update waits for a rare maintenance window, because a bad update costs product rather than just uptime: a discarded batch, a broken cold chain, or a quality deviation requiring investigation.
Two of the most common refrigeration controllers, the Copeland XWEB Pro and Danfoss AK-SM 800A, carry serious documented flaws.
Both vendors shipped firmware fixes months ago, yet thousands of units remain exposed. Zscaler uses the case to argue that patch availability is not the same as risk reduction in operational technology.