Skip to content
Threat Feed
Subscribe
high threat

Siemens Security Updates - October 2026

Roundup of Siemens security advisories published in October 2026.

CVE search metadata

CVE search record: CVE-2026-63353. Severity: critical. CVSS: 9.6. KEV: no. Product: SIMATIC S7-1500. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-63354. Severity: critical. CVSS: 9.6. KEV: no. Product: S7-1500. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-102073. Severity: high. CVSS: 8.2. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-102074. Severity: high. CVSS: 7.5. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-102075. Severity: high. CVSS: 7.5. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-102076. Severity: high. CVSS: 7.5. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-59241. Severity: high. CVSS: 8.8. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-72895. Severity: high. CVSS: 7.7. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-78557. Severity: high. CVSS: 8.3. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

CVE search record: CVE-2026-89199. Severity: high. CVSS: 8.8. KEV: no. Brief: Siemens Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-siemens-security-updates/

What's new

This roundup covers 15 Siemens security vulnerabilities. CVSS base scores range from 7.5 to 9.6. None are reported as actively exploited at the time of release. The issues affect .NET Client Library for SIMATIC S7 Webserver API, APOGEE MBC, Industrial Edge App Publisher, RUGGEDCOM CROSSBOW, S7-1500, SIMATIC IPC BX-21A, SIMATIC S7-1500, SIMATIC WinCC.

Summary

CVEProductSeverityCVSSEPSSKEVSource
CVE-2026-63353SIMATIC S7-1500Critical9.6noNVD (authoritative)
CVE-2026-63354S7-1500Critical9.6noNVD (authoritative)
CVE-2026-102073APOGEE MBC (PPC) (BACnet) (All versions)High8.2noNVD (authoritative)
CVE-2026-102074APOGEE MBC (PPC) (BACnet) (All versions)High7.5noNVD (authoritative)
CVE-2026-102075APOGEE MBC (PPC) (BACnet) (All versions)High7.5noNVD (authoritative)
CVE-2026-102076APOGEE MBC (PPC) (BACnet) (All versions)High7.5noNVD (authoritative)
CVE-2026-59241SIMATIC WinCC (V7.5)High8.8noNVD (authoritative)
CVE-2026-72895SIMATIC IPC BX-21A (< V31.01.13)High7.7noNVD (authoritative)
CVE-2026-78556Industrial Edge App Publisher (< V1.27.9)noNVD (authoritative)
CVE-2026-78557Industrial Edge App Publisher (< V1.27.9)High8.3noNVD (authoritative)
CVE-2026-85114.NET Client Library for SIMATIC S7 Webserver API (< V3.3.61)noNVD (authoritative)
CVE-2026-89196RUGGEDCOM CROSSBOW (< V6.0)noNVD (authoritative)
CVE-2026-89197RUGGEDCOM CROSSBOW (< V6.0)noNVD (authoritative)
CVE-2026-89198RUGGEDCOM CROSSBOW (< V6.0)noNVD (authoritative)
CVE-2026-89199RUGGEDCOM CROSSBOW (< V6.0)noNVD (authoritative)

CVE-2026-63353

CVE-2026-63353 is a stored cross-site scripting (XSS) vulnerability in the Trace file import functionality of affected industrial devices. An attacker can craft a malicious trace file containing JavaScript in the comment fields, which executes in the context of an authorized user's browser when viewed on the Trace page. This allows the attacker to hijack the user's session and perform unauthorized PLC operations via the web interface.

Affected products:

  • SIMATIC S7-1500

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63353

CVE-2026-63354

A vulnerability in the processing of imported CSV trace files allows for stored cross-site scripting (XSS). An attacker can supply a specially crafted CSV file containing malicious JavaScript, which executes in the context of an authenticated user's browser session upon viewing the Trace page. This enables the attacker to perform unauthorized PLC operations via the web interface within the scope of the victim's privileges.

Affected products:

  • S7-1500

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-63354

CVE-2026-102073

The web service component in several Siemens APOGEE and TALON building automation controllers fails to properly validate the length of user-controllable input. This vulnerability allows an unauthenticated remote attacker to perform out-of-bounds memory reads or trigger a denial-of-service condition.

Affected products:

  • APOGEE MBC (PPC) (BACnet) (All versions)
  • APOGEE MBC (PPC) (P2 Ethernet) (All versions)
  • APOGEE MEC (PPC) (BACnet) (All versions)
  • APOGEE MEC (PPC) (P2 Ethernet) (All versions)
  • APOGEE PXC Compact (BACnet) (< V3.5.7)
  • APOGEE PXC Compact (P2 Ethernet) (< V2.8.21)
  • APOGEE PXC Modular (BACnet) (< V3.5.7)
  • APOGEE PXC Modular (P2 Ethernet) (< V2.8.21)
  • TALON TC Compact (BACnet) (< V3.5.7)
  • TALON TC Modular (BACnet) (< V3.5.7)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-102073

Related in this roundup: CVE-2026-102074, CVE-2026-102075, CVE-2026-102076.

CVE-2026-102074

A vulnerability in the FTP service of various Siemens APOGEE and TALON building automation controllers allows an unauthenticated remote attacker to trigger a denial of service condition. The flaw stems from improper input length validation, which can be exploited by sending specially crafted inputs to the affected devices.

Affected products:

  • APOGEE MBC (PPC) (BACnet) (All versions)
  • APOGEE MBC (PPC) (P2 Ethernet) (All versions)
  • APOGEE MEC (PPC) (BACnet) (All versions)
  • APOGEE MEC (PPC) (P2 Ethernet) (All versions)
  • APOGEE PXC Compact (BACnet) (< V3.5.7)
  • APOGEE PXC Compact (P2 Ethernet) (< V2.8.21)
  • APOGEE PXC Modular (BACnet) (< V3.5.7)
  • APOGEE PXC Modular (P2 Ethernet) (< V2.8.21)
  • TALON TC Compact (BACnet) (< V3.5.7)
  • TALON TC Modular (BACnet) (< V3.5.7)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-102074

Related in this roundup: CVE-2026-102073, CVE-2026-102075, CVE-2026-102076.

CVE-2026-102075

A vulnerability in the web service of multiple Siemens APOGEE and TALON automation controllers stems from improper validation of user input during multipart handling. An unauthenticated remote attacker could exploit this flaw to trigger a denial of service condition.

Affected products:

  • APOGEE MBC (PPC) (BACnet) (All versions)
  • APOGEE MBC (PPC) (P2 Ethernet) (All versions)
  • APOGEE MEC (PPC) (BACnet) (All versions)
  • APOGEE MEC (PPC) (P2 Ethernet) (All versions)
  • APOGEE PXC Compact (BACnet) (< V3.5.7)
  • APOGEE PXC Compact (P2 Ethernet) (< V2.8.21)
  • APOGEE PXC Modular (BACnet) (< V3.5.7)
  • APOGEE PXC Modular (P2 Ethernet) (< V2.8.21)
  • TALON TC Compact (BACnet) (< V3.5.7)
  • TALON TC Modular (BACnet) (< V3.5.7)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-102075

Related in this roundup: CVE-2026-102073, CVE-2026-102074, CVE-2026-102076.

CVE-2026-102076

A vulnerability in the web service of various Siemens APOGEE and TALON building automation controllers exists due to improper validation of user-supplied input during file uploads. An unauthenticated remote attacker can exploit this flaw to trigger a denial of service condition on the affected devices.

Affected products:

  • APOGEE MBC (PPC) (BACnet) (All versions)
  • APOGEE MBC (PPC) (P2 Ethernet) (All versions)
  • APOGEE MEC (PPC) (BACnet) (All versions)
  • APOGEE MEC (PPC) (P2 Ethernet) (All versions)
  • APOGEE PXC Compact (BACnet) (< V3.5.7)
  • APOGEE PXC Compact (P2 Ethernet) (< V2.8.21)
  • APOGEE PXC Modular (BACnet) (< V3.5.7)
  • APOGEE PXC Modular (P2 Ethernet) (< V2.8.21)
  • TALON TC Compact (BACnet) (< V3.5.7)
  • TALON TC Modular (BACnet) (< V3.5.7)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-102076

Related in this roundup: CVE-2026-102073, CVE-2026-102074, CVE-2026-102075.

CVE-2026-59241

Siemens SIMATIC WinCC contains a privilege escalation vulnerability due to insufficiently restricted permissions on a database role. An authenticated remote attacker with database access can exploit this flaw to execute arbitrary commands on the underlying host system, leading to full system compromise.

Affected products:

  • SIMATIC WinCC (V7.5)
  • SIMATIC WinCC (V8.0 < Update 11)
  • SIMATIC WinCC (V8.1 < Update 7)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-59241

CVE-2026-72895

Siemens SIMATIC IPC devices contain a BIOS vendor test key within the UEFI Secure Boot database. A local attacker with physical or administrative access can leverage this key to sign and execute unauthorized operating systems or UEFI applications, effectively bypassing Secure Boot protections. Successful exploitation leads to a compromise of device integrity and confidentiality.

Affected products:

  • SIMATIC IPC BX-21A (< V31.01.13)
  • SIMATIC IPC RW-543A (< V1.1.4)
  • SIMATIC IPC227G (< V28.01.15)
  • SIMATIC IPC277G (< V28.01.15)
  • SIMATIC IPC277G PRO (< V28.01.15)
  • SIMATIC IPC327G (< V28.01.15)
  • SIMATIC IPC377G (< V28.01.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-72895

CVE-2026-78556

Industrial Edge App Publisher versions prior to V1.27.9 are vulnerable to a man-in-the-middle (MitM) attack due to improper server certificate validation during TLS connection initiation. An attacker can exploit this flaw to intercept, relay, or spoof communication between the client and the intended server.

Affected products:

  • Industrial Edge App Publisher (< V1.27.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-78556

Related in this roundup: CVE-2026-78557.

CVE-2026-78557

CVE-2026-78557 is a vulnerability in Siemens Industrial Edge App Publisher version < V1.27.9 caused by improper sanitization of backend data before frontend rendering. This lack of input validation enables Stored Cross-Site Scripting (XSS) within the Node.js integrated environment, which can be weaponized to achieve Remote Code Execution (RCE) on the host machine.

Affected products:

  • Industrial Edge App Publisher (< V1.27.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-78557

Related in this roundup: CVE-2026-78556.

CVE-2026-85114

A path traversal vulnerability exists in the .NET Client Library for SIMATIC S7 Webserver API due to improper validation of filenames during ticket downloads. An attacker who can manipulate the ticket response can perform arbitrary file writes outside the intended directory, potentially overwriting existing files within the application's context.

Affected products:

  • .NET Client Library for SIMATIC S7 Webserver API (< V3.3.61)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-85114

CVE-2026-89196

RUGGEDCOM CROSSBOW versions prior to V6.0 contain a SQL injection vulnerability within the Bulk Import/Export workflow. An authenticated attacker with sufficient privileges can exploit improper input validation of facility names to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data access or modification.

Affected products:

  • RUGGEDCOM CROSSBOW (< V6.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89196

Related in this roundup: CVE-2026-89197, CVE-2026-89198, CVE-2026-89199.

CVE-2026-89197

RUGGEDCOM CROSSBOW versions prior to V6.0 are vulnerable to SQL injection due to improper input validation in the Value field of notification conditions within the Notification Profile configuration. An authenticated attacker with sufficient privileges can exploit this vulnerability to execute arbitrary SQL commands against the backend database.

Affected products:

  • RUGGEDCOM CROSSBOW (< V6.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89197

Related in this roundup: CVE-2026-89196, CVE-2026-89198, CVE-2026-89199.

CVE-2026-89198

A vulnerability in RUGGEDCOM CROSSBOW versions prior to V6.0 allows an authenticated attacker to perform SQL injection by providing a maliciously crafted filename during firmware upload, leading to arbitrary database command execution.

Affected products:

  • RUGGEDCOM CROSSBOW (< V6.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89198

Related in this roundup: CVE-2026-89196, CVE-2026-89197, CVE-2026-89199.

CVE-2026-89199

RUGGEDCOM CROSSBOW versions prior to V6.0 are vulnerable to an improper access control issue in database queries. An authenticated attacker can exploit this flaw to retrieve sensitive administrative credentials, leading to privilege escalation and unauthorized access to internal systems.

Affected products:

  • RUGGEDCOM CROSSBOW (< V6.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89199

Related in this roundup: CVE-2026-89196, CVE-2026-89197, CVE-2026-89198.