CVE-2026-33862

mediumpriority · track · 24EPSS 0.002 · 9 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.19% (9th) EPSS

CVSS 6.1 · medium

Is it mine?

69 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-26

A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcenter V2412 (All versions < V2412.0009), Teamcenter V2506 (All versions < V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedTeamcenter V2312siemens_psirt
Update to V2312.0014 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2406siemens_psirt
Update to V2406.0012 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2412siemens_psirt
Update to V2412.0009 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2506siemens_psirt
Update to V2506.0005 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2312cisa_csaf_ot
Update to V2312.0014 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2406cisa_csaf_ot
Update to V2406.0012 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2412cisa_csaf_ot
Update to V2412.0009 or later version
https://support.sw.siemens.com/product/282219420/
FixedTeamcenter V2506cisa_csaf_ot
Update to V2506.0005 or later version
https://support.sw.siemens.com/product/282219420/

cvss

Technical severity, 0–10. One row per scoring source.

8.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–8.5

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · CISA US

v3.17.3highAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · productcert@siemens.com DEexploitability 2.1 · impact 5.2

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · Siemens ProductCERT DE

v4.08.5highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.5highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.06mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79USCWE-79USCWE-79USCWE-79US

affected products (69)

Products and version ranges known to be affected.

Teamcenter V2312all versionscisa_csaf_otUS
Teamcenter V2406all versionscisa_csaf_otUS
Teamcenter V2412all versionscisa_csaf_otUS
Teamcenter V2506all versionscisa_csaf_otUS
Teamcenter V2512all versionsnot affectedcisa_csaf_otUS
Siemens Teamcenter V2312≤ vers:intdot/<2312.0014cisa_csaf_otUS
Siemens Teamcenter V2406≤ vers:intdot/<2406.0012cisa_csaf_otUS
Siemens Teamcenter V2412≤ vers:intdot/<2412.0009cisa_csaf_otUS
Siemens Teamcenter V2506≤ vers:intdot/<2506.0005cisa_csaf_otUS
Siemens Teamcenter V2512≤ vers:all/*not affectedcisa_csaf_otUS
Siemens Teamcenter V23120 → V2312.0014enisa_euvdEU
Siemens Teamcenter V24060 → V2406.0012enisa_euvdEU
Siemens Teamcenter V24120 → V2412.0009enisa_euvdEU
Siemens Teamcenter V25060 → V2506.0005enisa_euvdEU
Siemens AG Siemens Teamcenter≤ 2506.0005fstec_bduRU
Siemens AG Siemens Teamcenter≤ 2312.0014fstec_bduRU
Siemens AG Siemens Teamcenter≤ 2406.0012fstec_bduRU
Siemens AG Siemens Teamcenter≤ 2412.0009fstec_bduRU
Siemens IE/PB-Link Firmware (OS)≤ vers:unknown/*ncsc_nlNL
Siemens IE/PB-link Firmware≤ vers:unknown/*ncsc_nlNL

showing 20 of 69

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
SSA-827383SSA-827383: Multiple Vulnerabilities in Teamcenter2026-05-12csaf · siemens_psirtDE
Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions.
ICSA-26-134-04Siemens Teamcenter2026-05-12icsa · cisa_csaf_otUS
Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2026-05-12modified 2026-10-23

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan