Which versions of Opcenter X are affected by CVE-2026-56451?

Siemens Opcenter X manufacturing platform contains a critical unauthenticated authentication bypass that allows remote attackers to forge administrator credentials and gain full unauthorized access…

How to fix or mitigate CVE-2026-56451?

Within 24 hours: inventory Siemens Opcenter X systems (identify versions and network exposure) and immediately enforce network segmentation via firewall rules to restrict unauthenticated remote access to trusted management networks only. Within 7 days: enable comprehensive API and authentication event logging with alerting configured for anomalous administrative access, token creation, and impossible-travel logins; require multi-factor authentication for all remote administrative operations if available. Within 30 days: engage Siemens for an expedited patch and upgrade timeline to Opcenter X V2604 or later, and conduct forensic log analysis for evidence of prior exploitation attempts.

Opcenter X CVE-2026-56451

Q: What is the CVSS score of CVE-2026-56451?

CVE-2026-56451 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43650 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-14 siemens

GHSA-j4h7-9cc4-7f3r

Authentication Bypass Siemens Jwt Attack Opcenter X

10.0

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated remote JWT forgery (AV:N/AC:L/PR:N/UI:N) bypasses the auth subsystem to control protected resources (S:C) with full admin impersonation, giving C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 10:15 vuln.today

CVE Published

Jul 14, 2026 - 09:19 cve.org

CRITICAL 10.0

DescriptionCVE.org

A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.

AnalysisAI

Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.

Technical ContextAI

Opcenter X is Siemens' cloud-native Manufacturing Execution System (MES) / manufacturing operations management platform (CPE cpe:2.3:a:siemens:opcenter_x). The root cause is CWE-347 (Improper Verification of Cryptographic Signature), specifically a JWT algorithm-confusion / 'alg' header manipulation weakness. JWTs consist of a header declaring the signing algorithm, a payload of claims, and a signature. Secure implementations must pin the expected algorithm server-side; when the server instead trusts the header's declared algorithm, an attacker can downgrade to 'alg:none' (no signature verified) or trigger algorithm confusion (e.g., signing an RS256-expecting endpoint with the public key as an HMAC secret). Either variant lets a forged token pass verification, defeating the token's role as a trusted authentication assertion.

RemediationAI

Vendor-released patch: Opcenter X V2604 - upgrade all instances to V2604 or later, as this is the version in which the flaw is resolved. Consult the Siemens ProductCERT advisory SSA-096828 (https://cert-portal.siemens.com/productcert/html/ssa-096828.html) for definitive fix guidance. Until patching is complete, apply Siemens' standard OT compensating controls: restrict network access to the Opcenter X application so it is reachable only from trusted management networks and not the public internet (this limits the remote attack surface but does not stop an attacker already on the internal/OT network), place the application behind a reverse proxy or WAF that can enforce authentication or strip/inspect forged Authorization tokens, and monitor authentication logs for anomalous administrative logins or malformed JWTs. These controls reduce reachability but do not remediate the underlying algorithm-validation flaw, so upgrading to V2604 remains mandatory.