Siemens
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Siemens product.
RSS Feeds for Siemens security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Siemens products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Siemens Sorted by Most Security Vulnerabilities since 2018
Known Exploited Siemens Vulnerabilities
The following Siemens vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability |
An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. CVE-2016-8562 Exploit Probability: 3.6% |
March 3, 2022 |
By the Year
In 2026 there have been 134 vulnerabilities in Siemens with an average score of 7.1 out of ten. Last year, in 2025 Siemens had 212 security vulnerabilities published. Right now, Siemens is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.22
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 134 | 7.13 |
| 2025 | 212 | 7.35 |
| 2024 | 240 | 7.21 |
| 2023 | 208 | 7.51 |
| 2022 | 268 | 7.44 |
| 2021 | 322 | 7.16 |
| 2020 | 81 | 6.66 |
| 2019 | 137 | 7.43 |
| 2018 | 29 | 7.47 |
It may take a day or so for new Siemens vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Siemens Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-89207 | Sep 16, 2026 |
CVE-2026-89207: Unauth Remote Input Validation Flaw in Siemens WTV Web Interface (Pre3.94/4.17)A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access). |
|
| CVE-2026-67367 | Sep 08, 2026 |
Dir Traversal in SIMOVE Fleetmanager/SIPLANT HTTP Server (V < 3.1.13)A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets. |
|
| CVE-2026-62654 | Sep 08, 2026 |
Reyrolle 7SR5 maintenance mode exec flaw (v<2.70)A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code. |
|
| CVE-2026-62653 | Sep 08, 2026 |
Reyrolle 7SR5 <V2.70 mem corruption via firmwareupdate modeA vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device. |
|
| CVE-2026-62652 | Sep 08, 2026 |
Reyrolle 7SR5 Firmware Debug Symbols Leak (All < V2.70)A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities. |
|
| CVE-2026-62650 | Sep 08, 2026 |
Reyrolle 7SR5 <V2.70 RBAC Bypass in Web UIA vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level. |
|
| CVE-2026-62649 | Sep 08, 2026 |
Reyrolle 7SR5 Web Server DoS via Unbounded HTTP Requests (All < V2.70)A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition. |
|
| CVE-2026-62648 | Sep 08, 2026 |
Reyrolle 7SR5 V<2.70 - OOB Write in URL Pre-Auth HTTP Msg (Siemens)A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition. |
|
| CVE-2026-62647 | Sep 08, 2026 |
Reyrolle 7SR5 <v2.70: Predictable RNG Allows Auth BypassA vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device. |
|
| CVE-2026-62646 | Sep 08, 2026 |
Low-entropy Session ID in Reyrolle 7SR5 (V2.70)A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication. |
|
| CVE-2026-62645 | Sep 08, 2026 |
Reyrolle 7SR5 Auth Bypass via Web Interface (pre-V2.70)A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device. |
|
| CVE-2026-58113 | Sep 08, 2026 |
Siemens Teamcenter XSS via auth redirect ( V2606.2607)A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session. |
|
| CVE-2026-50093 | Sep 08, 2026 |
Root Upload Vulnerability in Siemens Siveillance Control <v4.0.11.2177 OIS ModuleA vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment. |
|
| CVE-2026-34223 | Sep 08, 2026 |
Desigo CC Client CCE via Malicious Graphics ScriptA vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization. |
|
| CVE-2026-80465 | Sep 03, 2026 |
Mendix SAML <v4.2.3 Signature Validation FlawA vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations. |
|
| CVE-2026-66155 | Aug 27, 2026 |
Element maps-ng <v47.12.3 XSS via si-map tooltip pointsA vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session. |
|
| CVE-2026-54548 | Aug 26, 2026 |
Kas <5.4: SSH No HostKeyCheck Persists Causing MITM riskkas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4. |
|
| CVE-2026-47192 | Aug 14, 2026 |
kas 4.8-5.3 repo config signature validation order flawkas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker must have gained control of a repository that a kas file of the victim is referencing. Furthermore, the following conditions must be fulfilled: the victim's kas configuration must include a configuration file from the attacked repository; the repository state is referenced by tag, and no commit ID is specified (this is triggering a warning, though); the key used for validating the tag or commit signature is stored as file in a repository; no fingerprint for the key is specified; and the `_source_dir` key must not be set by the victim when calling kas (e.g. by avoiding a local `.config.yaml`). Given these conditions, the attacker could modify the included kas configuration in way that the key used to validate the tag signature of the attacker's repository could be replaced by an attacker-chosen key. No other exploit possibilities have been identified so far, but this does not rule out that those may exist. All patches have been released along with kas version 5.3. As a workaround, pin the expected signature key via its fingerprint, also when storing it as file in a repository. |
|
| CVE-2026-47191 | Aug 14, 2026 |
kas <5.3: Commit ID Validation Bypass via Branch Collisionkas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one. |
|
| CVE-2026-69109 | Aug 11, 2026 |
Siemens SLS <5.3 Path Traversal: Arbitrary File AccessA vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application. |
|
| CVE-2026-69108 | Aug 11, 2026 |
Siemens License Server <5.1 Local Privilege Escalation via insecure sudoersA vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise. |
|
| CVE-2026-64629 | Aug 11, 2026 |
OOB Read in Parasolid V38.0/V38.1 (<38.0.235/<38.1.230) X_T ParserA vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. |
Parasolid
|
| CVE-2026-59701 | Aug 11, 2026 |
Simcenter Femap <V2606.0001 BMP OOB Read VulnerabilityA vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process. |
Simcenter Femap
|
| CVE-2026-59700 | Aug 11, 2026 |
Simcenter Femap < V2606.0001: OOB Read in BMP Parsing Enables Code ExecutionA vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process. |
Simcenter Femap
|
| CVE-2026-59693 | Aug 11, 2026 |
Desigo Devices DoS via Malformed BACnet (v<01.21.233.16-7862)A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality. |
|
| CVE-2026-59086 | Aug 11, 2026 |
Simcenter Nastran Stack Overflow (V<2606)A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process. |
Simcenter Femap
|
| CVE-2026-58115 | Aug 11, 2026 |
SIMATIC IoT2050 Node-RED Auth Bypass (V4.3.4.0) Arbitrary System ExecA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server. This could allow an unauthenticated remote attacker to create malicious flows through the HTTP interface in order to execute arbitrary code on the underlying server with maximum privileges. |
|
| CVE-2026-57263 | Aug 11, 2026 |
LOGO! Soft Comfort Hash Exposure via Unsalted SHA-256 Project PasswordsA vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash. |
Logo Soft Comfort
|
| CVE-2026-57262 | Aug 11, 2026 |
LOGO! Soft Comfort Hardcoded AES Master Key Decryption VulnerabilityA vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or remove project passwords entirely without knowing the actual user-defined password. |
Logo Soft Comfort
|
| CVE-2026-50064 | Aug 11, 2026 |
Solid Edge SE2025/SE2026 OOB Write in PSM Parser (pre 225.0U15/226.0U7)A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-50063 | Aug 11, 2026 |
Solid Edge SE2025/SE2026 OOB Read in PAR Parser (pre V225 U15 / V226 U7)A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-50062 | Aug 11, 2026 |
Solid Edge SE2025/2026 OOB Read in PAR Files (V<225.0u15, <226.0u7)A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-50061 | Aug 11, 2026 |
UEF in Solid Edge SE2025/SE2026 <V225.0 Up15 / <V226.0 Up7 USING DFT parseA vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-50060 | Aug 11, 2026 |
Use-After-Free in Siemens Solid Edge (V < 225.0 U15/226.0 U7) Lead to Code ExecutionA vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-50059 | Aug 11, 2026 |
Solid Edge SE2025/SE2026 OOB Write in DFT Parser (V226.0 Update7)A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-50058 | Aug 11, 2026 |
Solid Edge SE2025/SE2026: OOB Read in DFT Parser (V225.0-U15 / V226.0-U7)A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. |
Solid Edge
|
| CVE-2026-3014 | Jul 14, 2026 |
XProtect Management Server API Arbitrary Code Exec Before 25.4Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service. |
|
| CVE-2026-56451 | Jul 14, 2026 |
Opcenter X JWT Header Alg Validation Unauth Auth BypassA vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application. |
|
| CVE-2026-54429 | Jul 14, 2026 |
Denial of Service via Multicast Traffic in Siemens SIMATIC S7-PLCSIM AdvancedA vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected application becomes inaccessible and requires a manual restart; no project data is lost. Successful exploitation requires a specific project configuration to be already active on the targeted instance. |
Simatic S7 Plcsim Advanced
|
| CVE-2025-40945 | Jul 14, 2026 |
Siemens IAM Client SDK untrusted search path (< V10.6.1)A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All versions < V2506.0003), Simcenter Femap V2512 (All versions < V2512.0002), Simcenter Nastran (All versions < V2606), Simcenter STAR-CCM+ (All versions < V2606), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Teamcenter Visualization V2412 (All versions < V2412.0012), Teamcenter Visualization V2506 (All versions < V2506.0009), Teamcenter Visualization V2512 (All versions < V2512.2605), Tecnomatix Plant Simulation V2404 (All versions < V2404.0022), Tecnomatix Plant Simulation V2504 (All versions < V2504.0010), Tecnomatix Process Simulate (All versions < V2606). Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access. |
Comos
Simcenter Femap
Solid Edge
And others... |
| CVE-2026-54801 | Jul 09, 2026 |
Siemens CPCI85 & SICORE: Auth Bypass via Web API (<=V26.20)A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges. |
|
| CVE-2026-54800 | Jul 09, 2026 |
OPC UA Security Disabled in Siemens CPCI85 & SICORE Base <26.20 ExploitA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions. |
|
| CVE-2026-54799 | Jul 09, 2026 |
CPCI85/SICORE Base Firmware Update Signature Validation Flaw (<V26.20)A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise. |
|
| CVE-2026-54798 | Jul 09, 2026 |
CPCI85/SICORE Base DoS via HTTP Debug (All < V26.20)A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions. |
|
| CVE-2026-48192 | Jun 30, 2026 |
Mendix Studio Pro 10.x-11.9 Remote Code Exec via Project File BuildA vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user. |
|
| CVE-2026-46749 | Jun 09, 2026 |
SINEC INS <V1.0 SP2 Update 6 Weak PasswordHashingA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access. |
Sinec Ins
|
| CVE-2026-46748 | Jun 09, 2026 |
Siemens SINEC INS < V1.0 SP2 Update 6 Priv Esc via cap_dac_overrideA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification and gaining root privileges on the system. |
Sinec Ins
|
| CVE-2026-46747 | Jun 09, 2026 |
SINEC INS v<1.0 SP2 Update6 PT via /api/sftp/uploadFilesA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used for directory listing. This allows path traversal through crafted input, enabling access to unintended file system locations. |
Sinec Ins
|
| CVE-2026-46746 | Jun 09, 2026 |
SINEC INS < V1.0 SP2 U6: /api/sftp/uploadFiles Shell InjectionA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins). |
Sinec Ins
|
| CVE-2026-24349 | Jun 09, 2026 |
SIMATIC WinCC Unified PC Runtime: Key Material Leakage in CertMgrA vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information. |
Simatic Wincc
|