SIMATIC WinCC EUVD-2026-98380

Exploitation requires the attacker to already possess authenticated database access to the SIMATIC WinCC database (PR:L) and network reachability to that database service (AV:N); no user interaction is needed. The specific precondition is that the WinCC application assigns excessive permissions to a database role, so any principal mapped to that role can leverage it to run arbitrary OS commands on the WinCC host. Limiting factors: the attacker must first hold valid database credentials/role membership, and the WinCC database must be network-accessible to the attacker - in properly segmented OT environments where WinCC database access is restricted to trusted operator stations, the realistic attack surface is substantially reduced. Affected deployments: WinCC V7.5 (all versions), V8.0 before Update 11, and V8.1 before Update 7.

This is a credible operational-technology priority rather than an inflated high-CVSS issue, though not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the host - consistent with the CWE-266 (incorrect privilege assignment) weakness and the description of an authenticated database user escalating to arbitrary command execution. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by severity and the sensitivity of the asset (industrial HMI/SCADA) rather than by observed in-the-wild activity. The key limiting signal is PR:L: the attacker must already hold valid database access, which in well-segmented ICS networks is a meaningful barrier, so this is more realistically an insider/post-compromise privilege-escalation path than a mass-exploitable internet-facing bug. Note the subsequent-system metrics are N despite the description implying OS-level command execution - Siemens appears to treat the WinCC host as the vulnerable system itself rather than modeling a scope change; defenders should treat impact as full host compromise regardless.

An attacker who has obtained legitimate or stolen database credentials for a SIMATIC WinCC server (an insider, or an adversary who has already gained a foothold on the OT/IT network) connects to the WinCC database over the network. Abusing the over-permissioned database role, they execute operating-system commands on the WinCC host, escalating from database-level access to full compromise of the SCADA/HMI server. No public exploit code is known at time of analysis, so this would require custom exploitation.