Siemens has 98 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 56 in the last 90 days against 5 in the 90 before. The busiest recent month was October 2026 with 34. The median CVSS is 7.5 (high), with 8 rated critical. 2% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-79 (10) and CWE-89 (7). Most affected products: RUGGEDCOM CROSSBOW (11), Reyrolle 7SR5 (9), SIMATIC Drive Controller CPU 1504D TF (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 2% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —(2)
- Last 90 days
- 56 prev 5
Products
- RUGGEDCOM CROSSBOW 11
- Reyrolle 7SR5 9
- SIMATIC Drive Controller CPU 1504D TF 8
- solid_edge_se2025 7
- simatic_cn_4100_firmware 5
- APOGEE MBC (PPC) (BACnet) 4
Worst active — by depth score
CVE-2022-1292High· 7.3The c_rehash script does not properly sanitise shell metacharacters to prevent command injection69CVE-2026-110936Medium· 6.7A vulnerability has been identified in Siemens Software Center (All versions)62CVE-2022-2586Medium· 5.3It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.56CVE-2026-62645Critical· 9.8A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70)54CVE-2025-40765Critical· 9.8A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3)54
Siemens vulnerabilities
CVEs affecting Siemens, newest first. Open any entry for full detail, references, and exploit status.
98 CVEsRSS
CVE-2026-89209Medium· 6.8A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29)
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions …
CVE-2026-110936Medium· 6.7CISA KEVPoCA vulnerability has been identified in Siemens Software Center (All versions)
A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a spe…
CVE-2026-89208Medium· 5.3A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo …
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo …
CVE-2026-89206Medium· 6.3A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authent…
CVE-2026-89205Medium· 6.3A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated att…
CVE-2026-89204Medium· 5.4A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify,…
CVE-2026-89203Medium· 4.3A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for th…
CVE-2026-89202Medium· 6.5A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal pri…
CVE-2026-89201High· 7.5A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an…
CVE-2026-89200Medium· 6.7A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker …
CVE-2026-89199High· 8.8A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker …
CVE-2026-89198High· 8.8A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with…
CVE-2026-89197High· 8.8A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configur…
CVE-2026-89196High· 8.8A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenti…
CVE-2026-85115Medium· 5.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow …
CVE-2026-85114High· 7.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61)
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This coul…
CVE-2026-78557High· 8.3A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the fro…
CVE-2026-78556High· 7.4A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept…
CVE-2026-72895High· 7.7A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15)
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test…
CVE-2026-63357Medium· 6.1Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the fun…
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the fun…
CVE-2026-63356Medium· 6.1Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who …
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who …
CVE-2026-63355Medium· 6.1Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the …
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the …
CVE-2026-63354Critical· 9.6Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the fu…
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the fu…
CVE-2026-63353Critical· 9.6Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read …
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read …
CVE-2026-63352Medium· 6.1Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function ri…
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function ri…
CVE-2026-63351Medium· 6.1Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorize…
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorize…
CVE-2026-63350Critical· 9.6Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specia…
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specia…
CVE-2026-59241High· 8.8A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7)
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the …
CVE-2026-44415Critical· 9.1Affected systems do not properly restrict access to internal APIs and paths for authenticated users
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged t…
CVE-2026-44414Medium· 6.8A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 …
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 …