CyberWatch Newsroom Live Intel

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens RUGGEDCOM CROSSBOW Station Access Controller

View CSAF Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version. The following versions of Siemens RUGGEDCOM CROSSBOW Station Access Controller are affected: RUGGEDCOM CROSSBOW Station Access Controller (SAC) vers:intdot/ CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) 4 Vulnerabilities Numeric Truncation Error, Improper Clearing of Heap Memory Before Release ('Heap Inspection'), Improper Handling of Unicode Encoding, Heap-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2025-6965 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Read More 1 Affected Product RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-197 Numeric Truncation Error CVSS Version Base Score Base Severity Vector String 3.1 7.7 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L View CVE Details CVE-2025-70873 An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file. Read More 2 Affected Products RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N View CVE Details CVE-2025-71316 SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26. Read More 3 Affected Products RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-176 Improper Handling of Unicode Encoding CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2026-11822 SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database. Read More 4 Affected Products RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-122 Heap-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H View CVE Details CVE-2026-11824 SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5. Read More 5 Affected Products RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product Status: known_affected Remediations Vendor fix Update to V6.0 or later version Additional Metrics Relevant CWE: CWE-122 Heap-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-765416 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-765416 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens Capital Embedded AR Classic

View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Capital Embedded AR Classic are affected: Capital Embedded AR Classic 431-422 vers:all/* (CVE-2026-89208) Capital Embedded AR Classic R20-11 vers:intdot/ CVSS Vendor Equipment v3 5.3 Siemens Capital Embedded AR Classic 431-422 1 Vulnerability Out-of-bounds Read Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-89208 The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries. Read More 2 Affected Products Capital Embedded AR Classic 431-422 Product Status: known_affected Remediations Mitigation Apply network segmentation and put the ECUs behind properly configured gateways/firewalls No fix planned Currently no fix is planned Capital Embedded AR Classic R20-11 Product Status: known_affected Remediations Mitigation Apply network segmentation and put the ECUs behind properly configured gateways/firewalls Vendor fix Update to V2303 or later version Additional Metrics Relevant CWE: CWE-125 Out-of-bounds Read CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-055299 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-055299 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) vers:intdot/>=3.1.7 SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) vers:intdot/>=3.1.7 SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) vers:intdot/>=3.1.7 CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) 428 Vulnerabilities Access of Resource Using Incompatible Type ('Type Confusion'), Access of Uninitialized Pointer, Active Debug Code, Buffer Access with Incorrect Length Value, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Buffer Underwrite ('Buffer Underflow'), Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Deadlock, Divide By Zero, Expired Pointer Dereference, Exposure of Sensitive Information Due to Incompatible Policies, Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution, Improper Enforcement of Behavioral Workflow, Improper Following of Specification by Caller, Improper Handling of Invalid Use of Special Elements, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Neutralization of Null Byte or NUL Character, Improper Null Termination, Improper Privilege Management, Improper Resource Locking, Improper Resource Shutdown or Release, Improper Update of Reference Count, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Improperly Implemented Security Check for Standard, Incomplete Cleanup, Incomplete Internal State Distinction, Incorrect Calculation of Buffer Size, Incorrect Conversion between Numeric Types, Incorrect Privilege Assignment, Incorrect Synchronization, Incorrect Type Conversion or Cast, Integer Overflow or Wraparound, Loop with Unreachable Exit Condition ('Infinite Loop'), Memory Allocation with Excessive Size Value, Misinterpretation of Input, Missing Critical Step in Authentication, Missing Default Case in Multiple Condition Expression, Missing Encryption of Sensitive Data, Missing Initialization of Resource, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Missing Report of Error Condition, Missing Synchronization, Multiple Releases of Same Resource or Handle, NULL Pointer Dereference, Operation on a Resource after Expiration or Release, Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Race Condition within a Thread, Reachable Assertion, Release of Invalid Pointer or Reference, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Transmission of Private Resources into a New Sphere ('Resource Leak'), Trust of System Event Data, Unchecked Return Value, Uncontrolled Recursion, Untrusted Pointer Dereference, Use After Free, Use of Externally-Controlled Format String, Use of Uninitialized Resource, Use of Uninitialized Variable, Write-what-where Condition Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2021-41617 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Read More 5 Affected Products SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= V3.1.7 Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available Additional Metrics Relevant CWE: CWE-311 Missing Encryption of Sensitive Data CVSS Version Base Score Base Severity Vector String 3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2021-41617 CVE-2023-28531 CVE-2023-51384 CVE-2023-52927 CVE-2023-53292 CVE-2024-26783 CVE-2024-27056 CVE-2024-28956 CVE-2024-36903 CVE-2024-36927 CVE-2024-42079 CVE-2024-46786 CVE-2024-47736 CVE-2024-47809 CVE-2024-49968 CVE-2024-49994 CVE-2024-49998 CVE-2024-50014 CVE-2024-50063 CVE-2024-50164 CVE-2024-50298 CVE-2024-53124 CVE-2024-53170 CVE-2024-54458 CVE-2024-56631 CVE-2024-56703 CVE-2024-56719 CVE-2024-57917 CVE-2024-57924 CVE-2024-57973 CVE-2024-57977 CVE-2024-57979 CVE-2024-58011 CVE-2024-58016 CVE-2024-58020 CVE-2024-58056 CVE-2024-58058 CVE-2024-58061 CVE-2024-58086 CVE-2025-21645 CVE-2025-21648 CVE-2025-21655 CVE-2025-21676 CVE-2025-21682 CVE-2025-21702 CVE-2025-21705 CVE-2025-21706 CVE-2025-21707 CVE-2025-21718 CVE-2025-21731 CVE-2025-21745 CVE-2025-21758 CVE-2025-21760 CVE-2025-21764 CVE-2025-21765 CVE-2025-21780 CVE-2025-21795 CVE-2025-21796 CVE-2025-21802 CVE-2025-21814 CVE-2025-21846 CVE-2025-21853 CVE-2025-21861 CVE-2025-21863 CVE-2025-21864 CVE-2025-21867 CVE-2025-21875 CVE-2025-21887 CVE-2025-21913 CVE-2025-21919 CVE-2025-21925 CVE-2025-21926 CVE-2025-21938 CVE-2025-21959 CVE-2025-21999 CVE-2025-22005 CVE-2025-22015 CVE-2025-22055 CVE-2025-22056 CVE-2025-22060 CVE-2025-22083 CVE-2025-22090 CVE-2025-22095 CVE-2025-22107 CVE-2025-22111 CVE-2025-22121 CVE-2025-23136 CVE-2025-23143 CVE-2025-37785 CVE-2025-37909 CVE-2025-37917 CVE-2025-37945 CVE-2025-37959 CVE-2025-37964 CVE-2025-37972 CVE-2025-37980 CVE-2025-38125 CVE-2025-38162 CVE-2025-38192 CVE-2025-38201 CVE-2025-38232 CVE-2025-38322 CVE-2025-38591 CVE-2025-38614 CVE-2025-38681 CVE-2025-38704 CVE-2025-38721 CVE-2025-38725 CVE-2025-38727 CVE-2025-38732 CVE-2025-38736 CVE-2025-39681 CVE-2025-39691 CVE-2025-39721 CVE-2025-39748 CVE-2025-39756 CVE-2025-39764 CVE-2025-39770 CVE-2025-39773 CVE-2025-39782 CVE-2025-39795 CVE-2025-39826 CVE-2025-39827 CVE-2025-39845 CVE-2025-39866 CVE-2025-39871 CVE-2025-39931 CVE-2025-39953 CVE-2025-39955 CVE-2025-39964 CVE-2025-39977 CVE-2025-39978 CVE-2025-39980 CVE-2025-40022 CVE-2025-40070 CVE-2025-40078 CVE-2025-40080 CVE-2025-40105 CVE-2025-40135 CVE-2025-40149 CVE-2025-40196 CVE-2025-40219 CVE-2025-40261 CVE-2025-40300 CVE-2025-61984 CVE-2025-61985 CVE-2025-68206 CVE-2025-68261 CVE-2025-68264 CVE-2025-68265 CVE-2025-68266 CVE-2025-68291 CVE-2025-68337 CVE-2025-68349 CVE-2025-68363 CVE-2025-68371 CVE-2025-68724 CVE-2025-68725 CVE-2025-68742 CVE-2025-68764 CVE-2025-68773 CVE-2025-68776 CVE-2025-68782 CVE-2025-68787 CVE-2025-68788 CVE-2025-68798 CVE-2025-68803 CVE-2025-68814 CVE-2025-68816 CVE-2025-68818 CVE-2025-68820 CVE-2025-71064 CVE-2025-71075 CVE-2025-71079 CVE-2025-71085 CVE-2025-71086 CVE-2025-71088 CVE-2025-71095 CVE-2025-71097 CVE-2025-71098 CVE-2025-71104 CVE-2025-71112 CVE-2025-71113 CVE-2025-71114 CVE-2025-71120 CVE-2025-71123 CVE-2025-71131 CVE-2025-71161 CVE-2025-71162 CVE-2025-71163 CVE-2025-71185 CVE-2025-71186 CVE-2025-71189 CVE-2025-71190 CVE-2025-71191 CVE-2025-71197 CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267 CVE-2026-3497 CVE-2026-22977 CVE-2026-22979 CVE-2026-22980 CVE-2026-22982 CVE-2026-22992 CVE-2026-22994 CVE-2026-23003 CVE-2026-23005 CVE-2026-23010 CVE-2026-23011 CVE-2026-23019 CVE-2026-23026 CVE-2026-23038 CVE-2026-23054 CVE-2026-23060 CVE-2026-23083 CVE-2026-23084 CVE-2026-23086 CVE-2026-23087 CVE-2026-23095 CVE-2026-23100 CVE-2026-23103 CVE-2026-23110 CVE-2026-23111 CVE-2026-23113 CVE-2026-23154 CVE-2026-23204 CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245 CVE-2026-23255 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273 CVE-2026-23274 CVE-2026-23277 CVE-2026-23284 CVE-2026-23287 CVE-2026-23290 CVE-2026-23293 CVE-2026-23300 CVE-2026-23304 CVE-2026-23319 CVE-2026-23321 CVE-2026-23335 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351 CVE-2026-23359 CVE-2026-23365 CVE-2026-23368 CVE-2026-23370 CVE-2026-23378 CVE-2026-23379 CVE-2026-23381 CVE-2026-23391 CVE-2026-23392 CVE-2026-23397 CVE-2026-23398 CVE-2026-23399 CVE-2026-23414 CVE-2026-23422 CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446 CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23463 CVE-2026-23474 CVE-2026-23475 CVE-2026-27135 CVE-2026-31389 CVE-2026-31391 CVE-2026-31396 CVE-2026-31402 CVE-2026-31403 CVE-2026-31411 CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424 CVE-2026-31427 CVE-2026-31428 CVE-2026-31441 CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31449 CVE-2026-31450 CVE-2026-31452 CVE-2026-31466 CVE-2026-31469 CVE-2026-31485 CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507 CVE-2026-31508 CVE-2026-31515 CVE-2026-31518 CVE-2026-31521 CVE-2026-31533 CVE-2026-31546 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565 CVE-2026-31628 CVE-2026-31634 CVE-2026-31649 CVE-2026-31651 CVE-2026-31658 CVE-2026-31664 CVE-2026-31665 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671 CVE-2026-31674 CVE-2026-31680 CVE-2026-31681 CVE-2026-31682 CVE-2026-31700 CVE-2026-31737 CVE-2026-31752 CVE-2026-31761 CVE-2026-31768 CVE-2026-40355 CVE-2026-41989 CVE-2026-43011 CVE-2026-43024 CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028 CVE-2026-43030 CVE-2026-43033 CVE-2026-43035 CVE-2026-43038 CVE-2026-43040 CVE-2026-43057 CVE-2026-43071 CVE-2026-43085 CVE-2026-43089 CVE-2026-43116 CVE-2026-43216 CVE-2026-43303 CVE-2026-43492 CVE-2026-43499 CVE-2026-43501 CVE-2026-45841 CVE-2026-46015 CVE-2026-46021 CVE-2026-46033 CVE-2026-46037 CVE-2026-46040 CVE-2026-46046 CVE-2026-46086 CVE-2026-46101 CVE-2026-46116 CVE-2026-46132 CVE-2026-46172 CVE-2026-46173 CVE-2026-46174 CVE-2026-46193 CVE-2026-46303 CVE-2026-46306 CVE-2026-46323 CVE-2026-46333 CVE-2026-52910 CVE-2026-52912 CVE-2026-52930 CVE-2026-52933 CVE-2026-52942 CVE-2026-52943 CVE-2026-52946 CVE-2026-52970 CVE-2026-52986 CVE-2026-52998 CVE-2026-52999 CVE-2026-53001 CVE-2026-53002 CVE-2026-53006 CVE-2026-53012 CVE-2026-53050 CVE-2026-53134 CVE-2026-53218 CVE-2026-53219 CVE-2026-53223 CVE-2026-53236 CVE-2026-53239 CVE-2026-53249 CVE-2026-53268 CVE-2026-53269 CVE-2026-53275 CVE-2026-53295 CVE-2026-53352 CVE-2026-53400 CVE-2026-63810 CVE-2026-64279 CVE-2026-64317 CVE-2026-64370 CVE-2026-64371 CVE-2026-64375 CVE-2026-64411 CVE-2026-64412 CVE-2026-64413 CVE-2026-64422 CVE-2026-64423 CVE-2026-64425 CVE-2026-64538 CVE-2026-64545 CVE-2026-64552 CVE-2026-64560 Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security ( https://www.siemens.com/cert/operational-guidelines-industrial-securit y), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use . Recommended Practices CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-457936 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-457936 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens APOGEE, TALON and Desigo PXC/PXM Products

View CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected: APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (BACnet) vers:intdot/ APOGEE PXC Compact (P2 Ethernet) vers:intdot/ APOGEE PXC Modular (BACnet) vers:intdot/ APOGEE PXC Modular (P2 Ethernet) vers:intdot/ Desigo PXC00-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC00-U vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC001-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC100-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC12-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC128-U vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC200-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC22-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC22.1-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC36.1-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC50-E.D vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXC64-U vers:intdot/>=2.3 (CVE-2026-89208) Desigo PXM20-E vers:intdot/>=2.3 (CVE-2026-89208) TALON TC Compact (BACnet) vers:intdot/ TALON TC Modular (BACnet) vers:intdot/ CVSS Vendor Equipment v3 8.2 Siemens APOGEE MBC (PPC) (BACnet) 3 Vulnerabilities Out-of-bounds Read, Integer Underflow (Wrap or Wraparound), Stack-based Buffer Overflow Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-89208 The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries. Read More 13 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. No fix planned Currently no fix is planned Additional Metrics Relevant CWE: CWE-125 Out-of-bounds Read CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N View CVE Details CVE-2026-102073 The affected product web service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to read portions of device memory or to cause a denial-of-service condition. Read More 23 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-191 Integer Underflow (Wrap or Wraparound) CVSS Version Base Score Base Severity Vector String 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L View CVE Details CVE-2026-102074 The affected product FTP service does not properly validate the length of user-controllable input. This could allow an unauthenticated remote attacker to cause a denial of service. Read More 33 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-121 Stack-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-102075 The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service. Read More 43 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-121 Stack-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details CVE-2026-102076 The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service. Read More 53 Affected Products Desigo PXC00-U >= V2.3 Product Status: known_affected Remediations Desigo PXC001-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC100-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC12-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC128-U >= V2.3 Product Status: known_affected Remediations Desigo PXC200-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC22.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC36.1-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC50-E.D >= V2.3 Product Status: known_affected Remediations Desigo PXC64-U >= V2.3 Product Status: known_affected Remediations Desigo PXM20-E >= V2.3 Product Status: known_affected Remediations Desigo PXC00-E.D >= V2.3 Product Status: known_affected Remediations APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE MBC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MBC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned TALON TC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version TALON TC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE MEC (PPC) (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE MEC (PPC) (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) No fix planned Currently no fix is planned APOGEE PXC Compact (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Compact (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version APOGEE PXC Modular (BACnet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V3.5.7 or later version APOGEE PXC Modular (P2 Ethernet) Product Status: known_affected Remediations Mitigation CVE-2026-89208 - Apply network segmentation and put the controllers behind properly configured gateways/firewalls. Mitigation Disable the FTP/Web service (Note that the FTP/Web service is disabled by default on APOGEE, Desigo, and TALON products.) Vendor fix Update to V2.8.21 or later version Additional Metrics Relevant CWE: CWE-121 Stack-based Buffer Overflow CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment. Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-333035 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-333035 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens Industrial Edge Devices

View CSAF Summary Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens Industrial Edge Devices are affected: Industrial Edge Cloud Device (IECD) vers:intdot/ Industrial Edge Own Device (IEOD) vers:intdot/ Industrial Edge Virtual Device (IEVD) vers:intdot/ SCALANCE LPE9413 (6GK5998-3GS01-2AC2) vers:all/* (CVE-2026-44414) SCALANCE LPE9433 (6GK5998-3GS11-2AC2) vers:all/* (CVE-2026-44414) SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0) vers:all/* (CVE-2026-44415) SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1) vers:all/* (CVE-2026-44415) SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) vers:intdot/ SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) vers:intdot/ SIMATIC IPC BX-21A Industrial Edge Device vers:intdot/ SIMATIC IPC BX-39A Industrial Edge Device vers:intdot/ SIMATIC IPC BX-59A Industrial Edge Device vers:intdot/ SIMATIC IPC127E Industrial Edge Device vers:intdot/ SIMATIC IPC227E Industrial Edge Device vers:intdot/ SIMATIC IPC227G Industrial Edge Device vers:intdot/ SIMATIC IPC427E Industrial Edge Device vers:intdot/ SIMATIC IPC847E Industrial Edge Device vers:intdot/ SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1) vers:all/* (CVE-2026-44415) SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1) vers:all/* (CVE-2026-44415) SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1) vers:all/* (CVE-2026-44415) CVSS Vendor Equipment v3 9.1 Siemens Industrial Edge Cloud Device (IECD) 1 Vulnerability Path Traversal: '.../...//' Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-44414 Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system. Read More 15 Affected Products Industrial Edge Cloud Device (IECD) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Own Device (IEOD) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version Industrial Edge Virtual Device (IEVD) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1 or later version SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IPC BX-21A Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V1.28.1-2 or later version SIMATIC IPC BX-39A Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC BX-59A Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC127E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC227E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC227G Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC427E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version SIMATIC IPC847E Industrial Edge Device Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only Vendor fix Update to V3.2.0-17 or later version Additional Metrics Relevant CWE: CWE-35 Path Traversal: '.../...//' CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N View CVE Details CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data. Read More 66 Affected Products Industrial Edge Cloud Device (IECD) Product Status: known_affected Remediations Industrial Edge Own Device (IEOD) Product Status: known_affected Remediations Industrial Edge Virtual Device (IEVD) Product Status: known_affected Remediations SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product Status: known_affected Remediations SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product Status: known_affected Remediations SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2) Product Status: known_affected Remediations SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2) Product Status: known_affected Remediations SIMATIC IPC BX-21A Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC BX-39A Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC BX-59A Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC127E Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC227E Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC227G Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC427E Industrial Edge Device Product Status: known_affected Remediations SIMATIC IPC847E Industrial Edge Device Product Status: known_affected Remediations SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design (6AV2128-3MB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1200 Unified Comfort Panel neutral design (6AV2128-3MB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel (6AV2128-3UB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel hygienic (6AV2128-3UB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design (6AV2128-3UB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1900 Unified Comfort Panel neutral design (6AV2128-3UB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3XB27-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3XB27-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3XB27-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3XB57-1BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3XB57-0BX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3XB57-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Hygienic (6AV2128-3XB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design (6AV2128-3XB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Panel (6AV2128-3XB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP2200 Unified Comfort Panel neutral design (6AV2128-3XB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700 Unified Comfort Panel (6AV2128-3GB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design (6AV2128-3GB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP700, Unified Comfort Panel neutral design (6AV2128-3GB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000 Unified Comfort Panel (6AV2128-3KB06-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIPLUS HMI MTP1000 Unified Comfort (6AG1128-3KB06-4AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIPLUS HMI MTP1200 Unified Comfort (6AG1128-3MB06-4AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIPLUS HMI MTP700 Unified Comfort (6AG1128-3GB06-4AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000 Unified Comfort Panel hygienic (6AV2128-3KB40-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design (6AV2128-3KB70-0AX0) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available SIMATIC HMI MTP1000, Unified Comfort Panel neutral (6AV2128-3KB36-0AX1) Product Status: known_affected Remediations Mitigation Ensure network access to affected products is limited to trusted parties only None available Currently no fix is available Additional Metrics Relevant CWE: CWE-35 Path Traversal: '.../...//' CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-832641 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-832641 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens Software Center

View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it. The following versions of Siemens Software Center are affected: Siemens Software Center vers:intdot/ CVSS Vendor Equipment v3 6.7 Siemens Siemens Software Center 1 Vulnerability Uncontrolled Search Path Element Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-110936 The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Read More 1 Affected Product Siemens Software Center Product Status: known_affected Remediations Vendor fix Update to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link) Additional Metrics Relevant CWE: CWE-427 Uncontrolled Search Path Element CVSS Version Base Score Base Severity Vector String 3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-580366 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-15 Date Revision Summary 2026-10-15 1 Publication Date 2026-10-17 2 Added remediation for Siemens Software Center 2026-10-19 3 Added reference to blog post about active exploitation of the vulnerability 2026-10-22 4 Initial CISA Republication of Siemens ProductCERT SSA-580366 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens RUGGEDCOM APE1808 Devices

View CSAF Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information. The following versions of Siemens RUGGEDCOM APE1808 Devices are affected: RUGGEDCOM APE1808 vers:all/* (CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920) CVSS Vendor Equipment v3 7.5 Siemens RUGGEDCOM APE1808 4 Vulnerabilities Improper Neutralization of Special Elements Used in a Template Engine, Incorrect Authorization, Lack of Administrator Control over Security, Cross-Site Request Forgery (CSRF) Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability. Read More 1 Affected Product RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine CVSS Version Base Score Base Severity Vector String 3.1 4.6 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L View CVE Details CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials. Read More 2 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L View CVE Details CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations. Read More 3 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-671 Lack of Administrator Control over Security CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L View CVE Details CVE-2026-33391 An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network. Read More 4 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L View CVE Details CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail. Read More 5 Affected Products RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information RUGGEDCOM APE1808 with Nozomi Guardian/CMC Product Status: known_affected Remediations Vendor fix Contact customer support to receive patch and update information Additional Metrics Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF) CVSS Version Base Score Base Severity Vector String 3.1 3.5 LOW CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-911336 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-911336 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens SIMATIC S7-1500 TM MFP

View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 TM MFP are affected: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem vers:all/* CVSS Vendor Equipment v3 10 Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 377 Vulnerabilities Access of Uninitialized Pointer, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Deadlock, Detection of Error Condition Without Action, Double Free, Expired Pointer Dereference, Heap-based Buffer Overflow, Improper Control of Resource Identifiers ('Resource Injection'), Improper Control of a Resource Through its Lifetime, Improper Handling of Length Parameter Inconsistency, Improper Handling of Missing Special Element, Improper Handling of Structural Elements, Improper Input Validation, Improper Locking, Improper Resource Locking, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Update of Reference Count, Improper Validation of Array Index, Improper Validation of Consistency within Input, Improper Validation of Specified Index, Position, or Offset in Input, Improper Validation of Specified Quantity in Input, Improper Validation of Specified Type of Input, Incorrect Synchronization, Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Default Case in Multiple Condition Expression, Missing Initialization of Resource, Missing Lock Check, Missing Release of Memory after Effective Lifetime, Missing Release of Resource after Effective Lifetime, Multiple Locks of a Critical Resource, NULL Pointer Dereference, Operation on a Resource after Expiration or Release, Out-of-bounds Read, Out-of-bounds Write, Plaintext Storage of a Password, Release of Invalid Pointer or Reference, Return of Wrong Status Code, Signal Handler Race Condition, Time-of-check Time-of-use (TOCTOU) Race Condition, Unchecked Return Value, Use After Free, Use of Incorrect Operator, Use of Uninitialized Resource, Write-what-where Condition Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2023-52927 In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl. Read More 1 Affected Product SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Product Status: known_affected Remediations Mitigation Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only. Mitigation Only build and run applications from trusted sources. None available Currently no fix is available Additional Metrics Relevant CWE: CWE-20 Improper Input Validation CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details CVE-2023-52927 CVE-2023-53292 CVE-2023-54271 CVE-2024-26982 CVE-2024-36922 CVE-2024-40945 CVE-2024-47809 CVE-2024-49998 CVE-2024-53166 CVE-2024-56647 CVE-2024-56657 CVE-2024-56719 CVE-2024-57977 CVE-2024-57979 CVE-2024-57980 CVE-2024-57981 CVE-2024-57986 CVE-2024-57993 CVE-2024-57996 CVE-2024-58002 CVE-2024-58005 CVE-2024-58009 CVE-2024-58013 CVE-2024-58014 CVE-2024-58017 CVE-2024-58020 CVE-2024-58058 CVE-2024-58061 CVE-2024-58063 CVE-2024-58068 CVE-2024-58071 CVE-2024-58072 CVE-2024-58077 CVE-2024-58079 CVE-2024-58083 CVE-2025-21682 CVE-2025-21700 CVE-2025-21702 CVE-2025-21703 CVE-2025-21704 CVE-2025-21705 CVE-2025-21706 CVE-2025-21707 CVE-2025-21708 CVE-2025-21716 CVE-2025-21719 CVE-2025-21724 CVE-2025-21725 CVE-2025-21726 CVE-2025-21727 CVE-2025-21728 CVE-2025-21731 CVE-2025-21735 CVE-2025-21738 CVE-2025-21744 CVE-2025-21745 CVE-2025-21753 CVE-2025-21756 CVE-2025-21758 CVE-2025-21760 CVE-2025-21761 CVE-2025-21762 CVE-2025-21763 CVE-2025-21764 CVE-2025-21765 CVE-2025-21766 CVE-2025-21767 CVE-2025-21776 CVE-2025-21779 CVE-2025-21787 CVE-2025-21790 CVE-2025-21791 CVE-2025-21795 CVE-2025-21796 CVE-2025-21806 CVE-2025-21814 CVE-2025-21830 CVE-2025-21832 CVE-2025-21835 CVE-2025-21838 CVE-2025-21844 CVE-2025-21846 CVE-2025-21858 CVE-2025-21859 CVE-2025-21862 CVE-2025-21863 CVE-2025-21864 CVE-2025-21865 CVE-2025-22105 CVE-2025-23131 CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250 CVE-2025-38584 CVE-2025-38704 CVE-2025-39748 CVE-2025-39863 CVE-2025-39997 CVE-2025-40135 CVE-2025-68206 CVE-2025-68239 CVE-2025-68265 CVE-2026-23066 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141 CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23231 CVE-2026-23245 CVE-2026-23253 CVE-2026-23255 CVE-2026-23270 CVE-2026-23271 CVE-2026-23272 CVE-2026-23273 CVE-2026-23274 CVE-2026-23277 CVE-2026-23278 CVE-2026-23279 CVE-2026-23281 CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23296 CVE-2026-23300 CVE-2026-23302 CVE-2026-23303 CVE-2026-23304 CVE-2026-23310 CVE-2026-23312 CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319 CVE-2026-23321 CVE-2026-23336 CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351 CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367 CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378 CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388 CVE-2026-23389 CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396 CVE-2026-23397 CVE-2026-23398 CVE-2026-23399 CVE-2026-23442 CVE-2026-23444 CVE-2026-31407 CVE-2026-31449 CVE-2026-31451 CVE-2026-31488 CVE-2026-31500 CVE-2026-31532 CVE-2026-31580 CVE-2026-31583 CVE-2026-31586 CVE-2026-31611 CVE-2026-31612 CVE-2026-31613 CVE-2026-31617 CVE-2026-31622 CVE-2026-31624 CVE-2026-31625 CVE-2026-31629 CVE-2026-31630 CVE-2026-31637 CVE-2026-31642 CVE-2026-31673 CVE-2026-31676 CVE-2026-31681 CVE-2026-31685 CVE-2026-31694 CVE-2026-31696 CVE-2026-31697 CVE-2026-31698 CVE-2026-31699 CVE-2026-31700 CVE-2026-31704 CVE-2026-31705 CVE-2026-31708 CVE-2026-31709 CVE-2026-31711 CVE-2026-31712 CVE-2026-43052 CVE-2026-43071 CVE-2026-43074 CVE-2026-43080 CVE-2026-43085 CVE-2026-43089 CVE-2026-43093 CVE-2026-43094 CVE-2026-43099 CVE-2026-43110 CVE-2026-43111 CVE-2026-43112 CVE-2026-43114 CVE-2026-43116 CVE-2026-43117 CVE-2026-43303 CVE-2026-43350 CVE-2026-43421 CVE-2026-43492 CVE-2026-43493 CVE-2026-43496 CVE-2026-43499 CVE-2026-43502 CVE-2026-43503 CVE-2026-45834 CVE-2026-45835 CVE-2026-45836 CVE-2026-45838 CVE-2026-45839 CVE-2026-45840 CVE-2026-45841 CVE-2026-45842 CVE-2026-45843 CVE-2026-45844 CVE-2026-45850 CVE-2026-45991 CVE-2026-45997 CVE-2026-46003 CVE-2026-46015 CVE-2026-46018 CVE-2026-46021 CVE-2026-46022 CVE-2026-46023 CVE-2026-46026 CVE-2026-46033 CVE-2026-46037 CVE-2026-46038 CVE-2026-46040 CVE-2026-46044 CVE-2026-46046 CVE-2026-46047 CVE-2026-46050 CVE-2026-46051 CVE-2026-46056 CVE-2026-46064 CVE-2026-46065 CVE-2026-46069 CVE-2026-46070 CVE-2026-46083 CVE-2026-46086 CVE-2026-46088 CVE-2026-46092 CVE-2026-46099 CVE-2026-46101 CVE-2026-46102 CVE-2026-46107 CVE-2026-46110 CVE-2026-46113 CVE-2026-46116 CVE-2026-46120 CVE-2026-46122 CVE-2026-46124 CVE-2026-46125 CVE-2026-46128 CVE-2026-46136 CVE-2026-46137 CVE-2026-46146 CVE-2026-46149 CVE-2026-46150 CVE-2026-46151 CVE-2026-46159 CVE-2026-46161 CVE-2026-46163 CVE-2026-46165 CVE-2026-46167 CVE-2026-46168 CVE-2026-46172 CVE-2026-46173 CVE-2026-46177 CVE-2026-46180 CVE-2026-46185 CVE-2026-46187 CVE-2026-46190 CVE-2026-46191 CVE-2026-46193 CVE-2026-46195 CVE-2026-46196 CVE-2026-46209 CVE-2026-46214 CVE-2026-46227 CVE-2026-46234 CVE-2026-46243 CVE-2026-46275 CVE-2026-46294 CVE-2026-46303 CVE-2026-46304 CVE-2026-46306 CVE-2026-46307 CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323 CVE-2026-46331 CVE-2026-52909 CVE-2026-52910 CVE-2026-52917 CVE-2026-52918 CVE-2026-52923 CVE-2026-52928 CVE-2026-52929 CVE-2026-52930 CVE-2026-52942 CVE-2026-52943 CVE-2026-52946 CVE-2026-52947 CVE-2026-52948 CVE-2026-53080 CVE-2026-53131 CVE-2026-53146 CVE-2026-53147 CVE-2026-53148 CVE-2026-53149 CVE-2026-53150 CVE-2026-53167 CVE-2026-53168 CVE-2026-53177 CVE-2026-53181 CVE-2026-53183 CVE-2026-53184 CVE-2026-53192 CVE-2026-53198 CVE-2026-53208 CVE-2026-53212 CVE-2026-53218 CVE-2026-53219 CVE-2026-53221 CVE-2026-53225 CVE-2026-53227 CVE-2026-53228 CVE-2026-53236 CVE-2026-53239 CVE-2026-53242 CVE-2026-53245 CVE-2026-53249 CVE-2026-53253 CVE-2026-53254 CVE-2026-53255 CVE-2026-53256 CVE-2026-53263 CVE-2026-53264 CVE-2026-53265 CVE-2026-53268 CVE-2026-53269 CVE-2026-53275 CVE-2026-53325 CVE-2026-53337 CVE-2026-53349 CVE-2026-53350 CVE-2026-53352 CVE-2026-53356 CVE-2026-53358 CVE-2026-53362 CVE-2026-64560 Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-784472 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-784472 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens SIMATIC S7 Webserver API

View CSAF Summary .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version. The following versions of Siemens SIMATIC S7 Webserver API are affected: .NET Client Library for SIMATIC S7 Webserver API vers:intdot/ CVSS Vendor Equipment v3 7.5 Siemens .NET Client Library for SIMATIC S7 Webserver API 2 Vulnerabilities Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-85114 Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application. Read More 1 Affected Product .NET Client Library for SIMATIC S7 Webserver API Product Status: known_affected Remediations Vendor fix Update to V3.3.61 or later version Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N View CVE Details CVE-2026-85115 Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC. Read More 2 Affected Products .NET Client Library for SIMATIC S7 Webserver API Product Status: known_affected Remediations .NET Client Library for SIMATIC S7 Webserver API Product Status: known_affected Remediations Vendor fix Update to V3.3.62 or later version Additional Metrics Relevant CWE: CWE-209 Generation of Error Message Containing Sensitive Information CVSS Version Base Score Base Severity Vector String 3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-390352 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-390352 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Siemens WinCC

View CSAF Summary Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available. The following versions of Siemens WinCC are affected: SIMATIC WinCC V7.5 vers:all/* (CVE-2026-59241) SIMATIC WinCC V8.0 vers:intdot/ SIMATIC WinCC V8.1 vers:intdot/ CVSS Vendor Equipment v3 8.8 Siemens SIMATIC WinCC V7.5 1 Vulnerability Incorrect Privilege Assignment Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-59241 The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system. Read More 3 Affected Products SIMATIC WinCC V7.5 Product Status: known_affected Remediations None available Currently no fix is available SIMATIC WinCC V8.0 Product Status: known_affected Remediations Vendor fix Update to V8.0 Update 11 or later version SIMATIC WinCC V8.1 Product Status: known_affected Remediations Vendor fix Update to V8.1 Update 7 or later version Additional Metrics Relevant CWE: CWE-266 Incorrect Privilege Assignment CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-550198 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-13 Date Revision Summary 2026-10-13 1 Publication Date 2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-550198 advisory Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Important CISA Advisory

2026-10-22 CISA Advisory

Kiloview E3 NDI Encoder

View CSAF Summary Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware CVSS Vendor Equipment v3 9.9 Kiloview E3 Firmware 6 Vulnerabilities Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Missing Authentication for Critical Function, Insufficient Session Expiration, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), NULL Pointer Dereference, Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Communications, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material. Read More 1 Affected Product Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-111100 The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and their privilege levels. This aids attackers in fingerprinting vulnerable devices and preparing targeted credential attacks. Read More 2 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-306 Missing Authentication for Critical Function CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-96616 Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period. Read More 3 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-613 Insufficient Session Expiration CVSS Version Base Score Base Severity Vector String 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N 4.0 8.3 HIGH CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-105265 A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory Read More 4 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N 4.0 6 MEDIUM CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-110491 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device. Read More 5 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-476 NULL Pointer Dereference CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N View CVE Details CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise. Read More 6 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root. Read More 7 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVSS Version Base Score Base Severity Vector String 3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H View CVE Details CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions. Read More 8 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-798 Use of Hard-coded Credentials CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass. Read More 9 Affected Products Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Kiloview E3 Firmware: Product Status: known_affected Remediations Mitigation KiloView recommends users update to V1.30: https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/ Additional Metrics Relevant CWE: CWE-306 Missing Authentication for Critical Function CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details Acknowledgments Juan Alonso reported these vulnerabilities to CISA. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet . Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-10-22 Date Revision Summary 2026-10-22 1 Initial Publication Legal Notice and Terms of Use

Fix: Review CISA guidance and apply vendor security updates immediately.

Cybersecurity Advisory

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

Fingerprint uses AI coding tools to automate fraud detection setup

Fingerprint has announced Agentic Installation, the AI-powered onboarding path for companies to deploy device intelligence to their websites or apps in minutes to detect and stop fraud. By running a single prompt in an AI coding tool, such as Claude Code, Codex or Cursor, developers take Fingerprint from zero to production-ready in minutes, reducing manual s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important BleepingComputer

2026-10-22 BleepingComputer

GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

XTIUM expands XTAI with centralized AI governance and cost management

XTIUM has released the latest version of XTAI (XTIUM Trusted AI), expanding its AI Service Platform with XTAI Orchestrator. The new governance platform brings together managed AI services, AI-powered voice, custom XTAI Agents, managed networks, and managed cloud. Building on XTAI’s initial focus on AI assessment, planning, governance, adoption, and deploymen…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

SentinelOne brings runtime threat detection and response to AI agents

SentinelOne has unveiled Singularity Agentic Detection and Response (ADR), a new offering that discovers AI agents, enforces what agents are allowed to do, monitors agent behavior in depth, and detects and stops unintended and malicious activity in real time. Bringing together visibility and governance of agent activity with SentinelOne’s signature runtime b…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Malwarebytes Labs

2026-10-22 Malwarebytes Labs

Woman faces years in prison over a Cash App account she says she never opened

A Cash App account opened in her name has left Amanda Smith facing criminal charges and potentially up to six years in prison. 404 Media reports that Smith says someone used her Social Security number (SSN) and date of birth to create an account that received money from a Facebook Marketplace scam. Allegedly, a buyer sent $1,000 for items that weren’t really…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

Broadcom adds real-time scam detection to 3-D Secure authentication

Broadcom has announced the launch of Arcot Scam Defense, a new feature of Arcot by Broadcom, designed to block social engineering fraud during card-not-present (CNP) transactions. “Financial institutions are experiencing broad increases in fraud attempts driven by sophisticated, AI-enhanced social engineering attacks,” said Matt Cooke, VP and GM, Payment Sec…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate The Hacker News

2026-10-22 The Hacker News

Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it sa…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important Help Net Security

2026-10-22 Help Net Security

Claude Security can now spot vulnerabilities that reappear in code

Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for vulnerabilities and suggests patches for review. It is powered by the company’s full family of models, including Claude Mythos, without requiring Cyber Verification Pro…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Infosecurity Magazine

2026-10-22 Infosecurity Magazine

Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants

Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory

Important Help Net Security

2026-10-22 Help Net Security

Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks

A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard 2024 that you never made. Under “Ship To,” where an address should be, sits the word “Helpline” and a phone number – the hook fo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important The Hacker News

2026-10-22 The Hacker News

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in ver…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important Help Net Security

2026-10-22 Help Net Security

What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers

Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet. Fortinet and Cisco published their own advisories, and neither company has confirmed a vulnerable product…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Infosecurity Magazine

2026-10-22 Infosecurity Magazine

PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure

Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory