Which versions of SIMATIC WinCC Unified are affected by CVE-2026-24349?

Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to Update 2) contain a high-severity vulnerability (CVE-2026-24349, CVSS 8.2) enabling local extraction of cryptographic key…

How to fix or mitigate CVE-2026-24349?

24 hours: Inventory all SIMATIC WinCC deployments (V16-V21 pre-Update 2) and assess local access controls on affected HMI workstations. 7 days: Implement compensating controls including restricted local access policies and enhanced monitoring of certificate operations; begin planning upgrade to WinCC V21 Update 2 or later. 30 days: Complete upgrade of all affected systems to V21 Update 2+ or implement vendor-provided compensating controls; conduct security validation.

SIMATIC WinCC Unified CVE-2026-24349

Q: What is the CVSS score of CVE-2026-24349?

CVE-2026-24349 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35382 HIGH

Cleartext Storage in a File or on Disk (CWE-313)

2026-06-09 siemens

GHSA-vxrh-p77g-j346

Information Disclosure Simatic Wincc Unified Pc Runtime V16 Simatic Wincc Unified Pc Runtime V17 Simatic Wincc Unified Pc Runtime V18 Simatic Wincc Unified Pc Runtime V19 Simatic Wincc Unified Pc Runtime V20 Simatic Wincc Unified Pc Runtime V21

8.2

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

8.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (siemens) · only source for this CVE.

CVSS VectorVendor: siemens

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 10:33 vuln.today

CVSS changed

Jun 09, 2026 - 10:22 NVD

7.1 (HIGH) 8.2 (HIGH)

DescriptionCVE.org

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.

AnalysisAI

Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

SIMATIC WinCC Unified is Siemens' next-generation HMI/SCADA runtime widely deployed on Windows-based engineering and operator workstations in OT environments. The WinCC Certificate Manager handles PKI material used to authenticate runtime components, projects, and communications between HMIs, PLCs, and supervisory systems. CWE-313 (Cleartext Storage in a File or on Disk) indicates the certificate manager stores or exposes key material without adequate filesystem-level cryptographic protection (e.g., not using DPAPI binding, weak ACLs, or plaintext on disk), so any process or user able to read that location obtains usable secrets.

RemediationAI

Vendor-released patch: SIMATIC WinCC Unified PC Runtime V21 Update 2 - upgrade affected systems to that release per Siemens advisory SSA-063511 (https://cert-portal.siemens.com/productcert/html/ssa-063511.html). For V16-V20 where no equivalent patched build is indicated in the advisory, migrate to V21 Update 2 or apply Siemens' general ICS hardening guidance: restrict interactive and remote logon to WinCC Runtime hosts to a minimal operator/engineer set, tighten NTFS ACLs and enable BitLocker on workstations hosting the Certificate Manager to deny offline key extraction, segment the OT network so stolen certificates cannot reach broader systems, and plan certificate rotation after upgrade since previously exposed key material must be considered compromised. Note that BitLocker and ACL hardening do not stop a local administrator from reading keys at runtime, and certificate rotation will require coordinated downtime of dependent HMIs and PLCs.