CVE-2026-59241

highPriorität · verfolgen · 35EPSS 0.005 · 42. PerzentilDEFRNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.50% (42nd) EPSS

CVSS 8.8 · high

Is it mine?

243 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cisa_csaf_ot · ncsc_nl · siemens_psirt · certfr

EPSS · bewertet 2026-10-22

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC WinCC V8.0siemens_psirt
Update to V8.0 Update 11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818723/
BehobenSIMATIC WinCC V8.1siemens_psirt
Update to V8.1 Update 7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977191/
BehobenSIMATIC WinCC V8.0cisa_csaf_ot
Update to V8.0 Update 11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818723/
BehobenSIMATIC WinCC V8.1cisa_csaf_ot
Update to V8.1 Update 7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977191/
Kein Fix verfügbarSIMATIC WinCC V7.5siemens_psirt
Currently no fix is available
Kein Fix verfügbarSIMATIC WinCC V7.5cisa_csaf_ot
Currently no fix is available

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.3–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · productcert@siemens.com DEAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-266USCWE-266USCWE-266US

betroffene Produkte (243)

Betroffene Produkte und Versionsbereiche.

Siemens SIMATIC WinCC V7.5≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC WinCC V8.0≤ vers:intdot/<8.0.0.11cisa_csaf_otUS
Siemens SIMATIC WinCC V8.1≤ vers:intdot/<8.1.7cisa_csaf_otUS
Siemens .NET Client Library for SIMATIC S7 Webserver API≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC00-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC00-U≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC001-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC100-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC12-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC128-U≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC200-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC22-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC22.1-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC36.1-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC50-E.D≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXC64-U≤ vers:unknown/*ncsc_nlNL
Siemens Desigo PXM20-E≤ vers:unknown/*ncsc_nlNL
Siemens Industrial Edge App Publisher≤ vers:unknown/*ncsc_nlNL
Siemens Industrial Edge Device Kit - arm64 V1.10≤ vers:unknown/*ncsc_nlNL
Siemens Industrial Edge Device Kit - arm64 V1.11≤ vers:unknown/*ncsc_nlNL

20 von 243 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2026-0415Kwetsbaarheden verholpen in Siemens-productenNL2026-10-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.
SSA-550198SSA-550198: Authenticated Remote Code Execution in WinCC2026-10-13csaf · siemens_psirtDE
Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.
ICSA-26-295-13Siemens WinCC2026-10-13icsa · cisa_csaf_otUS
Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.
CERTFR-2026-AVI-1298Multiples vulnérabilités dans les produits SiemensFrançais2026-10-13vendor · certfrFR

quellen

Welche Quellen diesen Datensatz belegen und wann.

cisa_csaf_ot ncsc_nl siemens_psirt certfr NVD CVE.org MITRE

veröffentlicht 2026-10-13geändert 2026-10-16

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://cert-portal.siemens.com/productcert/html/ssa-550198.html

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan