← All Advisories

CVE-2026-59241

Last refreshed2026-10-13

Status: UPDATED  |  Advisory ID: CVE-2026-59241

Key Details

CVECVE-2026-59241
CVSS Score / Version
8.8 (High) / CVSS v3.1
Updated2026-10-13
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Siemens SIMATIC WinCC V7.5, Siemens SIMATIC WinCC V8.0, and Siemens SIMATIC WinCC V8.1
Classified as
CWE-266 (Incorrect Privilege Assignment)

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
SiemensSIMATIC WinCC V7.5
SiemensSIMATIC WinCC V8.0
SiemensSIMATIC WinCC V8.1
SubsystemsGeneral OT
SectorsMultiple

What to Know

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role.

This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-59241
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-59241

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE