CVE-2026-84854

highpriority · track · 0EPSS 0.001 · 1 %ileDENLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.10% (1st) EPSS
CVSS 7 · high
Is it mine?
242 products
Check your exposure
Who says so?
3 sources
cisa_csaf_ot · ncsc_nl · siemens_psirt

EPSS · scored 2026-10-26

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedPSS(R)SINCAL V22.5siemens_psirt

    Update to V22.5 Update 5 or later version

    https://www.simtec.cc/en/updates.aspx
  • FixedPSS(R)SINCAL V22.5cisa_csaf_ot

    Update to V22.5 Update 5 or later version

    https://www.simtec.cc/en/updates.aspx
  • MitigationPSS(R)SINCAL V21.5siemens_psirt

    Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.

  • MitigationPSS(R)SINCAL V22.0siemens_psirt

    Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.

  • MitigationPSS(R)SINCAL V21.5cisa_csaf_ot

    Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.

  • MitigationPSS(R)SINCAL V22.0cisa_csaf_ot

    Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.

  • No fix availablePSS(R)SINCAL V21.5siemens_psirt

    Currently no fix is available

  • No fix availablePSS(R)SINCAL V22.0siemens_psirt

    Currently no fix is available

  • No fix availablePSS(R)SINCAL V21.5cisa_csaf_ot

    Currently no fix is available

  • No fix availablePSS(R)SINCAL V22.0cisa_csaf_ot

    Currently no fix is available

02

cvss

Technical severity, 0–10. One row per scoring source.

7.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7

v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1 · impact 5.9
v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE
v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USCWE-787USCWE-787USCWE-787US
05

affected products (242)

Products and version ranges known to be affected.

showing 20 of 242
06

advisories (3)

Vendor and ecosystem advisories describing this.

  • NCSC-2026-0415Kwetsbaarheden verholpen in Siemens-productenNL2026-10-13csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.

  • SSA-148322SSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL2026-10-13csaf · siemens_psirtDE

    PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.

  • ICSA-26-295-06Siemens PSS(R)SINCAL2026-10-13icsa · cisa_csaf_otUS

    PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.

07

sources

Which sources assert this record, and when.

cisa_csaf_otncsc_nlsiemens_psirtNVDCVE.orgMITRE
published 2026-10-06modified 2026-10-15
08

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan