industrial-control-system-vulnerabilitywidely-deployed-product-advisorycritical-infrastructure-threatoperational-disruption

Siemens SICAM 8 Flaws Expose OT Devices to Denial-of-Service

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 27, 2026

Siemens disclosed multiple vulnerabilities in SICAM 8 industrial control system products affecting CPCI85 Central Processing/Communication, RTUM85 RTU Base, and the SICORE Base system, with vulnerable versions identified as releases prior to V26.10 or V26.10.0 depending on the product. The issues are tracked as CVE-2026-27663 and CVE-2026-27664, and can allow denial-of-service conditions in operational technology environments. Siemens published advisory SSA-246443, while the Canadian Centre for Cyber Security and CISA both urged asset owners to review the vendor guidance and apply the recommended updates.

According to CISA, CVE-2026-27663 is a resource exhaustion flaw in remote operation mode that can block parameterization and may require a reset or reboot, while CVE-2026-27664 is an out-of-bounds write triggered by specially crafted XML input that can crash the affected service. Siemens has released fixed versions and advised organizations to validate patches before deployment and harden network access with segmentation, firewalls, and VPNs; CISA further recommended minimizing internet exposure of control systems and isolating OT networks from business networks to reduce the risk of disruption.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Mar 26, 2026 – Apr 2, 2026

Apr 2, 20267mo ago
CISA republishes Siemens SICAM 8 advisory
On 2026-04-02, CISA republished the Siemens advisory to increase visibility, detailing the two denial-of-service vulnerabilities and their impact on SICAM 8 components. CISA also recommended minimizing internet exposure, isolating OT networks, and using segmentation, firewalls, and VPNs.
Mar 27, 20267mo ago
Canadian Centre for Cyber Security issues notice on Siemens advisory
On 2026-03-27, the Canadian Centre for Cyber Security published alert AV26-290 highlighting Siemens' advisory and the affected industrial control system products. It urged administrators to review Siemens' guidance, follow mitigations, and apply the necessary updates.
Mar 26, 20267mo ago
Siemens publishes advisory for SICAM 8 vulnerabilities
On 2026-03-26, Siemens published advisory SSA-246443 covering multiple vulnerabilities in SICAM 8 products affecting CPCI85 Central Processing/Communication, RTUM85 RTU Base, and SICORE Base system. The advisory identified denial-of-service issues tracked as CVE-2026-27663 and CVE-2026-27664 and provided updated versions and mitigation guidance.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Remote Operation DoS in Siemens SICAM A8000 CPCI85/RTUM85 (CVE-2026-27663)Out-of-bounds write in Siemens CPCI85/SICORE XML parser (CVE-2026-27664)

Affected products

4 linked

Cpci85 Central Processing/CommunicationSicam S8000Sicore Base SystemRtum85 Rtu Base

Organizations

1 linked

Siemens

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cisa AdvisoriesAdvisories · Apr 2, 2026

Siemens SICAM 8 Products | CISAOpen source ↗

Ca CcsNews · Mar 27, 2026

[Control systems] Siemens security advisory (AV26-290) - Canadian Centre for Cyber SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Siemens SICAM 8 Flaws Expose OT Devices to Denial-of-Service

How this story unfolded

CISA republishes Siemens SICAM 8 advisory

Canadian Centre for Cyber Security issues notice on Siemens advisory

Siemens publishes advisory for SICAM 8 vulnerabilities

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Siemens Issues Security Updates for Multiple Industrial and Engineering Products

Multiple Critical Vulnerabilities Disclosed in Industrial Control Systems by CISA

Siemens SIMATIC and SICAM Products Vulnerable to Trace-File Code Injection and Other Flaws

Siemens SICAM 8 Flaws Expose OT Devices to Denial-of-Service

How this story unfolded

CISA republishes Siemens SICAM 8 advisory

Canadian Centre for Cyber Security issues notice on Siemens advisory

Siemens publishes advisory for SICAM 8 vulnerabilities

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Siemens Issues Security Updates for Multiple Industrial and Engineering Products

Multiple Critical Vulnerabilities Disclosed in Industrial Control Systems by CISA

Siemens SIMATIC and SICAM Products Vulnerable to Trace-File Code Injection and Other Flaws