Which versions of Cpci85 Central Processing Communication are affected by CVE-2026-27663?

Siemens CPCI85 and RTUM85 industrial control devices (versions below V26.10) are vulnerable to remote denial-of-service attacks that can force unplanned system resets and loss of parameterization…

How to fix or mitigate CVE-2026-27663?

Within 24 hours: Inventory all CPCI85 and RTUM85 devices in your environment and confirm current firmware versions below V26.10. Within 7 days: Implement network segmentation to restrict access to affected devices from untrusted adjacent networks; review and harden ingress filtering rules. Within 30 days: Monitor Siemens security advisories for V26.10 release confirmation and plan upgrade testing in non-production environments; establish a change control schedule for production deployment once patch validation is complete.

Cpci85 Central Processing Communication CVE-2026-27663

Q: What is the CVSS score of CVE-2026-27663?

CVE-2026-27663 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16179 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-26 siemens

Denial Of Service Cpci85 Central Processing Communication Rtum85 Rtu Base

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 14:30 euvd

EUVD-2026-16179

Analysis Generated

Mar 26, 2026 - 14:30 vuln.today

CVE Published

Mar 26, 2026 - 14:03 nvd

HIGH 7.1

DescriptionCVE.org

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10). The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.

AnalysisAI

Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10) allows adjacent network attackers to exhaust system resources via high-volume requests, forcing device reset or reboot to restore parameterization functionality. No public exploit identified at time of analysis. CVSS 7.1 (High) with adjacent network access vector and no privileges required indicates moderate real-world risk for industrial environments where these RTU and control processing devices operate.

Technical ContextAI

This vulnerability affects Siemens industrial control system components used in SCADA and RTU deployments: CPCI85 Central Processing/Communication modules (cpe:2.3:a:siemens:cpci85_central_processing/communication) and RTUM85 RTU Base units (cpe:2.3:a:siemens:rtum85_rtu_base). The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), where the remote operation mode fails to implement rate limiting or request throttling mechanisms. When subjected to a flood of requests from adjacent network positions, the devices experience resource exhaustion that blocks legitimate parameterization operations. The vulnerability requires physical or logical adjacency (CVSS AV:A), suggesting the attack surface is limited to local industrial networks rather than internet-facing exposure.

RemediationAI

Upgrade CPCI85 Central Processing/Communication modules and RTUM85 RTU Base units to version V26.10 or later as specified in Siemens ProductCERT advisory SSA-246443 available at https://cert-portal.siemens.com/productcert/html/ssa-246443.html. Until patching is completed, implement network segmentation to restrict access to these devices from adjacent network segments, deploy intrusion detection systems to monitor for abnormal request volumes targeting the remote operation mode, and apply rate limiting at network perimeter devices where feasible. Consider disabling remote operation mode if not operationally required and enforce strict access controls limiting connections to authorized maintenance systems only.