Siemens

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Siemens product.

RSS Feeds for Siemens security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Siemens products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Siemens Sorted by Most Security Vulnerabilities since 2018

Siemens Teamcenter Visualization179 vulnerabilities

Siemens Jt2go140 vulnerabilities

Siemens Solid Edge105 vulnerabilities

Siemens Tecnomatix Plant Simulation95 vulnerabilities

Siemens Simcenter Femap85 vulnerabilities

Siemens Telecontrol Server Basic79 vulnerabilities

Siemens Sinema Remote Connect Server72 vulnerabilities

Siemens Sinec Nms52 vulnerabilities

Siemens Parasolid50 vulnerabilities

Siemens Sinec Ins41 vulnerabilities

Siemens Simatic Wincc41 vulnerabilities

Siemens Solid Edge Se202336 vulnerabilities

Siemens Simatic Cn 410033 vulnerabilities

Siemens Comos32 vulnerabilities

Siemens Simatic Pcs Neo32 vulnerabilities

Siemens Simatic Pcs 727 vulnerabilities

Siemens Simatic S7 1500 Software Controller24 vulnerabilities

Siemens Nucleus Readystart V322 vulnerabilities

Siemens Tecnomatix20 vulnerabilities

Siemens Ruggedcom Crossbow19 vulnerabilities

Siemens Simatic Rtls Locating Manager19 vulnerabilities

Siemens Simatic Step 719 vulnerabilities

Siemens Solid Edge Se202419 vulnerabilities

Siemens Sinec Traffic Analyzer15 vulnerabilities

Siemens Simatic S7 Plcsim Advanced15 vulnerabilities

Siemens Simatic Wincc Runtime Advanced14 vulnerabilities

Siemens Totally Integrated Automation Portal13 vulnerabilities

Siemens Spectrum Power 413 vulnerabilities

Siemens Scalance Lpe9403 Firmware12 vulnerabilities

Siemens Sinema Server12 vulnerabilities

Siemens Opcenter Quality11 vulnerabilities

Siemens Sipass Integrated10 vulnerabilities

Siemens Simatic Wincc Runtime Professional9 vulnerabilities

Siemens Sinec Security Monitor8 vulnerabilities

Siemens Sinumerik 840d Sl8 vulnerabilities

Siemens Logo Soft Comfort8 vulnerabilities

Siemens Simatic Net Pc8 vulnerabilities

Siemens Teamcenter8 vulnerabilities

Siemens Spectrum Power 77 vulnerabilities

Siemens Sinvrsivms Video Server7 vulnerabilities

Siemens Sinema Remote Connect Client7 vulnerabilities

Siemens Simatic Winac Rtx F 20107 vulnerabilities

Siemens Opcenter Execution Foundation7 vulnerabilities

Siemens Opcenter Intelligence6 vulnerabilities

Siemens Tia Administrator6 vulnerabilities

Siemens Polarion Alm5 vulnerabilities

Siemens Simatic Route Control5 vulnerabilities

Siemens Solid Edge Se20225 vulnerabilities

Siemens Simatic Batch5 vulnerabilities

Siemens Questa4 vulnerabilities

Siemens Desigo Cc4 vulnerabilities

Siemens Openpcs 74 vulnerabilities

Siemens Location Intelligence4 vulnerabilities

Siemens Modelsim4 vulnerabilities

Siemens Omnivise T3000 Application Server4 vulnerabilities

Siemens Simatic Easie Core Package4 vulnerabilities

Siemens Cerberus Pro Ul X300 Cloud3 vulnerabilities

Siemens Desigo Fire Safety Ul Compact Panel3 vulnerabilities

Siemens Desigo Fire Safety Ul Engineering Tool3 vulnerabilities

Siemens Logo3 vulnerabilities

Known Exploited Siemens Vulnerabilities

The following Siemens vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability	An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. CVE-2016-8562 Exploit Probability: 3.6%	March 3, 2022

By the Year

In 2026 there have been 117 vulnerabilities in Siemens with an average score of 7.1 out of ten. Last year, in 2025 Siemens had 212 security vulnerabilities published. Right now, Siemens is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.25

Year	Vulnerabilities	Average Score
2026	117	7.10
2025	212	7.35
2024	237	7.26
2023	208	7.51
2022	268	7.44
2021	322	7.16
2020	81	6.66
2019	137	7.43
2018	29	7.47

It may take a day or so for new Siemens vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Siemens Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-47192	Aug 14, 2026	kas 4.8-5.3 repo config signature validation order flaw kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker must have gained control of a repository that a kas file of the victim is referencing. Furthermore, the following conditions must be fulfilled: the victim's kas configuration must include a configuration file from the attacked repository; the repository state is referenced by tag, and no commit ID is specified (this is triggering a warning, though); the key used for validating the tag or commit signature is stored as file in a repository; no fingerprint for the key is specified; and the `_source_dir` key must not be set by the victim when calling kas (e.g. by avoiding a local `.config.yaml`). Given these conditions, the attacker could modify the included kas configuration in way that the key used to validate the tag signature of the attacker's repository could be replaced by an attacker-chosen key. No other exploit possibilities have been identified so far, but this does not rule out that those may exist. All patches have been released along with kas version 5.3. As a workaround, pin the expected signature key via its fingerprint, also when storing it as file in a repository.
CVE-2026-47191	Aug 14, 2026	kas <5.3: Commit ID Validation Bypass via Branch Collision kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.
CVE-2026-69109	Aug 11, 2026	Siemens SLS <5.3 Path Traversal: Arbitrary File Access A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.
CVE-2026-69108	Aug 11, 2026	Siemens License Server <5.1 Local Privilege Escalation via insecure sudoers A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.
CVE-2026-64629	Aug 11, 2026	OOB Read in Parasolid V38.0/V38.1 (<38.0.235/<38.1.230) X_T Parser A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.	Parasolid
CVE-2026-59701	Aug 11, 2026	Simcenter Femap <V2606.0001 BMP OOB Read Vulnerability A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-59700	Aug 11, 2026	Simcenter Femap < V2606.0001: OOB Read in BMP Parsing Enables Code Execution A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-59693	Aug 11, 2026	Desigo Devices DoS via Malformed BACnet (v<01.21.233.16-7862) A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.
CVE-2026-59086	Aug 11, 2026	Simcenter Nastran Stack Overflow (V<2606) A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-58115	Aug 11, 2026	SIMATIC IoT2050 Node-RED Auth Bypass (V4.3.4.0) Arbitrary System Exec A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges.
CVE-2026-57263	Aug 11, 2026	LOGO! Soft Comfort Hash Exposure via Unsalted SHA-256 Project Passwords A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash.	Logo Soft Comfort
CVE-2026-57262	Aug 11, 2026	LOGO! Soft Comfort Hardcoded AES Master Key Decryption Vulnerability A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or remove project passwords entirely without knowing the actual user-defined password.	Logo Soft Comfort
CVE-2026-50064	Aug 11, 2026	Solid Edge SE2025/SE2026 OOB Write in PSM Parser (pre 225.0U15/226.0U7) A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-50063	Aug 11, 2026	Solid Edge SE2025/SE2026 OOB Read in PAR Parser (pre V225 U15 / V226 U7) A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-50062	Aug 11, 2026	Solid Edge SE2025/2026 OOB Read in PAR Files (V<225.0u15, <226.0u7) A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-50061	Aug 11, 2026	UEF in Solid Edge SE2025/SE2026 <V225.0 Up15 / <V226.0 Up7 USING DFT parse A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-50060	Aug 11, 2026	Use-After-Free in Siemens Solid Edge (V < 225.0 U15/226.0 U7) Lead to Code Execution A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-50059	Aug 11, 2026	Solid Edge SE2025/SE2026 OOB Write in DFT Parser (V226.0 Update7) A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-50058	Aug 11, 2026	Solid Edge SE2025/SE2026: OOB Read in DFT Parser (V225.0-U15 / V226.0-U7) A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-3014	Jul 14, 2026	XProtect Management Server API Arbitrary Code Exec Before 25.4 Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.
CVE-2026-56451	Jul 14, 2026	Opcenter X JWT Header Alg Validation Unauth Auth Bypass A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.
CVE-2026-54429	Jul 14, 2026	Denial of Service via Multicast Traffic in Siemens SIMATIC S7-PLCSIM Advanced A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected application becomes inaccessible and requires a manual restart; no project data is lost. Successful exploitation requires a specific project configuration to be already active on the targeted instance.	Simatic S7 Plcsim Advanced
CVE-2025-40945	Jul 14, 2026	Siemens IAM Client SDK untrusted search path (< V10.6.1) A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.	Comos Simcenter Femap Solid Edge And others...
CVE-2026-54801	Jul 09, 2026	Siemens CPCI85 & SICORE: Auth Bypass via Web API (<=V26.20) A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.
CVE-2026-54800	Jul 09, 2026	OPC UA Security Disabled in Siemens CPCI85 & SICORE Base <26.20 Exploit A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.
CVE-2026-54799	Jul 09, 2026	CPCI85/SICORE Base Firmware Update Signature Validation Flaw (<V26.20) A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.
CVE-2026-54798	Jul 09, 2026	CPCI85/SICORE Base DoS via HTTP Debug (All < V26.20) A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.
CVE-2026-48192	Jun 30, 2026	Mendix Studio Pro 10.x-11.9 Remote Code Exec via Project File Build A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.
CVE-2026-46749	Jun 09, 2026	SINEC INS <V1.0 SP2 Update 6 Weak PasswordHashing A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access.	Sinec Ins
CVE-2026-46748	Jun 09, 2026	Siemens SINEC INS < V1.0 SP2 Update 6 Priv Esc via cap_dac_override A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification and gaining root privileges on the system.	Sinec Ins
CVE-2026-46747	Jun 09, 2026	SINEC INS v<1.0 SP2 Update6 PT via /api/sftp/uploadFiles A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used for directory listing. This allows path traversal through crafted input, enabling access to unintended file system locations.	Sinec Ins
CVE-2026-46746	Jun 09, 2026	SINEC INS < V1.0 SP2 U6: /api/sftp/uploadFiles Shell Injection A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).	Sinec Ins
CVE-2026-24349	Jun 09, 2026	SIMATIC WinCC Unified PC Runtime: Key Material Leakage in CertMgr A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.	Simatic Wincc
CVE-2025-40808	Jun 09, 2026	SIPROTEC 5: Authenticated File Upload via DIGSI 5 Enables RCE A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions), SIPROTEC 5 6MD89 (CP300) (All versions), SIPROTEC 5 6MU85 (CP300) (All versions), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions), SIPROTEC 5 7SJ81 (CP100) (All versions), SIPROTEC 5 7SJ81 (CP150) (All versions), SIPROTEC 5 7SJ82 (CP100) (All versions), SIPROTEC 5 7SJ82 (CP150) (All versions), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions), SIPROTEC 5 7SK82 (CP100) (All versions), SIPROTEC 5 7SK82 (CP150) (All versions), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions), SIPROTEC 5 7ST86 (CP300) (All versions), SIPROTEC 5 7SX82 (CP150) (All versions), SIPROTEC 5 7SX85 (CP300) (All versions), SIPROTEC 5 7SY82 (CP150) (All versions), SIPROTEC 5 7UM85 (CP300) (All versions), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions), SIPROTEC 5 7VE85 (CP300) (All versions), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions), SIPROTEC 5 7VU85 (CP300) (All versions), SIPROTEC 5 Compact 7SX800 (CP050) (All versions). The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution.
CVE-2026-41918	Jun 02, 2026	Browser Cache Sensitive Data Leakage in RUGGEDCOM RST2428P <4.0 A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0). The affected applications stores sensitive information in the browser cache when an authenticated user modify specific configurations. This could allow an authenticated attacker to access sensitive data stored in the browser.
CVE-2026-42177	May 12, 2026	Entra SSO Plug Prior 1.8.1: Chrome PRT Cookie Injection via Host Permissions linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/", i.e. "https://login.microsoftonline.com/". Chrome's urlFilter without a \| or \|\| anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https:///"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1.
CVE-2025-12659	May 12, 2026	ICS IPT Parser Memory Corruption Allows Code Execution Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.	Simcenter Femap
CVE-2026-44412	May 12, 2026	Solid Edge SE2026 V226.0 Update5: Stack Buffer Overflow in PAR Parser A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.	Solid Edge
CVE-2026-44411	May 12, 2026	Uninitialized Pointer in Solid Edge SE2026 <=226.0 Update5 PAR Parsing A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process.	Solid Edge
CVE-2026-41551	May 12, 2026	Remote Path Traversal in ROS# <V2.2.2 (All versions) A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized. This could allow a remote attacker to access arbitrary files on the device.
CVE-2026-41125	May 12, 2026	KACO Meteor SQLi Elevation via Unneutralized Params (All Blueplanet Series) A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M10 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions), blueplanet gridsave 110 TL3-S (All versions), blueplanet gridsave 137 TL3-S (All versions), blueplanet gridsave 92.0 TL3-S (All versions), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). Improper neutralization of special elements used in an sql command ('sql injection') in KACO Meteor server allows an authorized attacker to elevate privileges over a local network.
CVE-2026-33893	May 12, 2026	Teamcenter Hardcoded Keys in obfuscation (V2312-2512) A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versions < V2412.0009), Teamcenter V2506 (All versions < V2506.0005), Teamcenter V2512 (All versions). The affected application contains hardcoded key which is used for obfuscation stored directly into the application. This could allow an attacker to obtain these keys and misuse them to gain unauthorized access.
CVE-2026-33862	May 12, 2026	XSS in Siemens Teamcenter v<2312.0014/2406.0012/2412.0009/2506.0005/2512 A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versions < V2412.0009), Teamcenter V2506 (All versions < V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.
CVE-2026-27662	May 12, 2026	Siemens Control Panel Browser Access Bypass (CVE-2026-27662) Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.
CVE-2026-25789	May 12, 2026	Remote XSS via Firmware Update Filename Validation on Siemens Device Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-25787	May 12, 2026	Siemens XSS in Motion Control Diagnostics via unsanitized TO names Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-25786	May 12, 2026	Siemens PLC XSS: Unvalidated PLC/Station Names in Web Interface Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-22925	May 12, 2026	SIMATIC CN4100 <V5.0 Resource Exhaustion via SYN Flood (DOS) A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.	Simatic Cn 4100
CVE-2026-22924	May 12, 2026	SIMATIC CN4100 <V5.0: Unauth Conn Flaw Leads to Res Exhaustion A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.	Simatic Cn 4100
CVE-2025-40949	May 12, 2026	Cmd Inject via Scheduler in RuggedCom ROX <V2.17.1 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly sanitize user-supplied input in the Scheduler functionality of the Web UI, allowing commands to be injected into the task scheduling backend. This could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system.