Loading story…
Siemens disclosed multiple high-severity vulnerabilities in SINEC INS that affect all versions before V1.0 SP2 Update 6, including CVE-2026-46746 and CVE-2026-46748. The first flaw is an OS command injection issue in the /api/sftp/uploadFiles endpoint, where crafted directory names can plant shell payloads that execute when directory listings are viewed; Siemens said an authenticated remote attacker with low privileges could run arbitrary commands on the underlying operating system as the sinecins service user. The second flaw stems from a binary configured with the Linux capability CAP_DAC_OVERRIDE, allowing a local attacker to bypass file permission checks, modify files arbitrarily, and escalate privileges to root.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-09, CERT-FR issued an advisory stating that multiple vulnerabilities had been discovered in Siemens products. The notice said the flaws could enable arbitrary code execution, denial of service, and compromise of data confidentiality.
On 2026-06-09, Siemens published a broader security advisory covering multiple vulnerabilities across several industrial and automation products, including SINEC INS, SIPROTEC 5, TIA Portal, and products affected by an OpenSSL buffer overflow issue. The advisory included updates or mitigation guidance for the listed issues.
On 2026-06-09, Siemens published a security advisory covering multiple vulnerabilities in SINEC INS versions earlier than V1.0 SP2 Update 6, including CVE-2026-46746 and CVE-2026-46748. The issues include authenticated remote command injection and local privilege escalation to root.
On 2026-06-02, Siemens published advisory SSA-253495 covering multiple critical vulnerabilities affecting RUGGEDCOM RST2428P devices before version V4.0. The Canadian Centre for Cyber Security relayed the notice and urged users to apply mitigations and updates.
Siemens provided firmware version V2.4.24 as the fixed release for CVE-2025-40771, a missing-authentication flaw affecting several SIMATIC CP 1542SP-1, CP 1543SP-1, and SIPLUS ET 200SP variants. The vulnerability allows unauthenticated access to configuration data on affected devices running firmware earlier than V2.4.24.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecvefeed.io
Open sourcecert.ssi.gouv.fr
Open sourcecvefeed.io
Open sourcecyber.gc.ca
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Siemens published security advisories for multiple products**, prompting both CISA ICS advisories and a Canadian Centre for Cyber Security alert covering a broad set of affected industrial/engineering software and OT-adjacent components. Reported issues include a **stored XSS** in *Siemens Polarion* (CVE-2025-40587; CVSS 7.6) where authenticated users can inject JavaScript via crafted document titles, and **local privilege escalation** paths in *Siemens SINEC NMS* and its *User Management Component (UMC)* (CVE-2026-25655, CVE-2026-25656; CVSS 7.8) that allow low-privileged users to modify configuration/search paths to load malicious DLLs and potentially gain elevated execution (including SYSTEM-level impact). Siemens also addressed a **missing authorization** condition affecting *Siveillance Video Management Servers* Webhooks/MIP Webhooks API (CVSS 6.3), enabling a read-only user to obtain full API access. Additional advisories cover file-parsing and third-party component risks that can lead to crashes or potential code execution. *Siemens NX* is affected by multiple **CGM file parsing** flaws (CVE-2026-22923/22924/22925; CVSS 7.8) that can be triggered when a user opens a malicious file, and *Siemens Solid Edge* includes an **out-of-bounds read** in the PS/IGES Parasolid translator when processing crafted IGS files (CVSS 7.8). *Desigo CC* and *SENTRON Powermanager* are impacted via the third-party *WIBU Systems CodeMeter Runtime* chain tied to **CVE-2023-38545** (curl SOCKS5 heap overflow; CVSS 8.8), with Siemens providing component update instructions. *Siemens SINEC OS* before V3.3 aggregates a large set of third-party CVEs across supported platforms, and *Siemens COMOS* advisories include multiple issues (up to CVSS 10) spanning potential code execution, DoS, data exposure, and access control violations; Siemens recommends updating where fixes are available and applying countermeasures where they are not yet released.
Jun 29, 2026
Siemens remediated **12 vulnerabilities** in its SCALANCE LPE9403 industrial edge platform and optional SINEMA Remote Connect Edge Client. Nine flaws affect LPE9403 firmware before `V4.0 HF0`, while three affect SINEMA Remote Connect Edge Client versions before `V2.1`. The most serious attack chains allow a low-privileged local user—or an attacker controlling a trusted SINEMA Remote Connect Server—to gain root-level control of the device, which bridges OT and IT environments and forwards process telemetry to SCADA systems. Four additional flaws in the device’s PROFINET Discovery and basic Configuration Protocol daemon—`CVE-2025-40575` through `CVE-2025-40578`, each rated CVSS 4.0 5.3—allow an unauthenticated attacker on the same Layer 2 segment to crash the service using crafted Ethernet packets. Exploitation can interrupt device discovery, configuration, and IP assignment, potentially making assets appear unreachable to SCADA systems. Operators should apply Siemens’ updated firmware and client releases, segment OT networks, and monitor for exposed or vulnerable LPE9403 devices.
Sep 15, 2026
CISA published an ICS advisory warning that multiple **Siemens SIMATIC** controllers do not properly sanitize the contents of imported trace files, enabling **code injection** if an attacker can socially engineer a legitimate user into importing a specially crafted trace file. The affected product set includes a broad range of *SIMATIC* devices, including **SIMATIC Drive Controller CPU 1504D/1507D TF**, multiple **SIMATIC ET 200SP** CPU variants (including fail-safe models), and **SIMATIC S7-1500** CPUs, among others. CERT-FR also issued an advisory covering **multiple vulnerabilities in Siemens products**, listing impacts that include **remote code execution**, **denial of service**, and **indirect code injection (XSS)**, and enumerating overlapping affected systems such as the same *SIMATIC Drive Controller* and *SIMATIC ET 200SP* families. CERT-FR explicitly references **CVE-2025-40943** for several of these SIMATIC devices and additionally notes other Siemens components (e.g., **SICAM SIAPP SDK** versions prior to `2.1.7`), indicating the Siemens security updates/mitigations span more than one product line and vulnerability class beyond the trace-file injection issue highlighted by CISA.
Jun 29, 2026