Warehouse cyber security has come under renewed scrutiny after Kaspersky mapped how attackers could move through the connected systems behind order fulfilment. Published on 20 October 2026, the study also highlights a Bluetooth vulnerability that can turn certain wireless barcode scanners into a route to warehouse workstations.
Warehouse cyber security study follows one order
Kaspersky’s study follows a fictional paper unicorn through a modern warehouse. This simple journey illustrates how receiving, storage, picking, packing and dispatch now depend on interconnected information technology, operational technology and radio-enabled devices.
A warehouse management system, or WMS, sits at the centre of many of these processes. It records stock locations, issues picking instructions, coordinates equipment and exchanges information with ecommerce platforms, suppliers, transport providers and other business systems.
If an attacker disrupts the WMS, the consequences can quickly move from computer screens to the warehouse floor. Products may be shown as available when bins are empty, picking instructions can become unreliable, labels may be incorrect, conveyors can stop and trucks can leave without complete manifests.
The paper maps several potential entry points rather than presenting one universal attack method. These include:
- Internet-facing services and partner connections that exchange data with the WMS.
- Wi-Fi and Bluetooth links used by barcode scanners and portable data terminals.
- Network equipment located inside racking, mezzanines and other difficult-to-monitor areas.
- Thermal label printers, lifting equipment controllers and other edge devices connected to warehouse operations.
- Workstations that remain authenticated to WMS platforms while receiving input from peripheral devices.
This broad attack surface means warehouse cyber security is not limited to protecting a central server. A seemingly minor device used for scanning or printing can bridge physical operations and higher-value systems.
Bluetooth scanner flaw enables keystroke injection
The most specific technical finding concerns CVE-2026-4272, a missing authentication vulnerability affecting certain Honeywell handheld scanner base stations. The vulnerability was published in the US National Vulnerability Database on 5 April 2026 and was highlighted alongside Kaspersky’s report on 20 October 2026.
Wireless barcode scanners normally transmit scanned data to a base station. The base then forwards that input to a connected host computer, where it can appear as keyboard input inside the WMS or another application.
In the affected products, the base station does not adequately authenticate the source of Bluetooth input. An attacker within Bluetooth range could therefore send crafted input to the base, which passes it to the host computer as keystrokes.
This behaviour could enable command execution on a connected workstation. The risk is particularly significant where that computer is already logged in to a WMS, inventory application or another operational system, because the attacker may be able to act within the user’s existing session.
Affected Honeywell base station firmware
CVE-2026-4272 affects specific Honeywell scanner base models running firmware older than the fixed releases. The affected versions and update thresholds are:
- C1 Base using Ingenic x1000, versions before GK000432BAA.
- D1 Base using Ingenic x1600, versions before HE000085BAA.
- A1/B1 Base using IMX25, versions before BK000763BAA, BK000765BAA or CU000101BAA.
Organisations should identify the exact base model and installed firmware rather than checking only the handheld scanner. Firmware should meet or exceed the applicable fixed version distributed by Honeywell.
No public proof of concept or confirmed in-the-wild exploitation of CVE-2026-4272 had been documented in the referenced public reporting as of 20 October 2026. Kaspersky also published no associated file hashes, domains, IP addresses or other network indicators of compromise.
Warehouse cyber security incidents show the impact
The study places its attack paths in the context of three operational incidents. These events did not involve confirmed exploitation of CVE-2026-4272, but they demonstrate what can happen when warehouse systems or their suppliers become unavailable.
Blue Yonder disruption affected Morrisons
On 21 November 2024, ransomware affected Blue Yonder’s managed services hosted environment. UK reporting began on 25 November 2024, when Morrisons confirmed that its WMS for fresh and produce had been affected.
Morrisons used backup processes to maintain deliveries while recovery work continued. By 2 December 2024, the retailer said warehouse operations had largely recovered. The incident demonstrated that warehouse cyber security depends on service providers as well as systems physically located inside a distribution centre.
UNFI temporarily lost fulfilment capacity
United Natural Foods, Inc. discovered unauthorised activity in its IT systems on 5 June 2025. An initial filing with the US Securities and Exchange Commission on 9 June confirmed that the incident had temporarily affected order fulfilment and distribution.
UNFI submitted a follow-up filing on 21 June 2025. Public information confirmed genuine operational disruption, although it did not connect the incident to the Honeywell scanner vulnerability discussed in the later Kaspersky research.
Eight CEVA warehouses reportedly disrupted
Trade press coverage on 6 August 2026 reported that a cyberattack had disrupted operations at eight CEVA Logistics warehouses across Europe. Further reporting on 12 August identified affected customer operations and said some customer delivery information had been exposed.
The early reports relied partly on customer notifications and sources close to the investigation. CEVA did not initially provide detailed public confirmation of every exposed data element, so claims about the precise information involved should be treated with that qualification.
Why the warehouse attack paths matter
These incidents show that compromised availability or integrity can be as damaging as data theft. If staff cannot trust inventory records or issue correct picking instructions, an organisation may have to slow or stop fulfilment even when stock and machinery remain physically available.
The supplier dimension is also important. The Morrisons case shows how a ransomware incident in a hosted service environment can affect a customer’s warehouse without attackers first breaching that retailer’s local network.
For smaller UK operators, the same dependencies exist on a different scale. Wi-Fi scanners, label printers, hosted WMS platforms and third-party integrations are common in modest distribution facilities, making the study’s warehouse cyber security findings relevant beyond large logistics groups.
Actions tied to the Kaspersky findings
Organisations using Honeywell wireless scanner bases should first inventory models and firmware, then install the applicable fixed release. Scanner-connected workstations should be separated from unnecessary corporate and operational systems to limit movement if peripheral input is abused.
Security teams should also review the exposure points identified by the study:
- Restrict and monitor internet-facing WMS interfaces and partner connections.
- Assess Bluetooth and Wi-Fi coverage around warehouse boundaries.
- Locate and secure network ports and equipment hidden within operational areas.
- Review scanners, printers and controllers as potential access paths, not merely peripherals.
- Test backup fulfilment procedures for WMS or supplier outages.
The immediate priority is clear: patch the affected Honeywell bases and verify which devices can send input to authenticated warehouse computers. Broader resilience work should then focus on the connections most capable of stopping physical fulfilment.
Originally reported by securelist.com.
