41
CVEs
6
Critical
29
High
0
KEV
0
PoC
35
Unpatched C/H
2.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
29
MEDIUM
5
LOW
1
Monthly CVE Trend
Affected Products (30)
Teamcenter Visualization
143
Jt2Go
129
Debian Linux
91
Tecnomatix Plant Simulation
76
Telecontrol Server Basic
75
Simcenter Femap
67
Sinec Infrastructure Network Services
64
Fedora
58
Sinema Remote Connect Server
53
Scalance W1750D Firmware
51
Parasolid
50
Sinec Nms
42
Ubuntu Linux
36
Solid Edge Se2023
35
Sppa T3000 Ms3000 Migration Server
35
Solid Edge
34
Sinec Ins
33
Cloud Backup
33
Wincc
31
Clustered Data Ontap
30
Jt Utilities
29
Instant
28
Jt Open Toolkit
26
Arubaos
26
Node.js
26
Comos
25
Simatic Pcs7
25
Simatic Pcs Neo
24
Simatic Wincc
23
Splunk
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58115 | Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices. | CRITICAL | 10.0 | 0.7% | 61 |
No patch
|
| CVE-2026-69109 | Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance. | HIGH | 8.7 | 0.5% | 54 |
No patch
|
| CVE-2026-69108 | Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments. | HIGH | 8.3 | 0.1% | 52 |
No patch
|
| CVE-2026-56451 | Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-62645 | Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-62647 | Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-67367 | Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.2 | 0.8% | 47 |
No patch
|
| CVE-2026-59086 | Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50058 | Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50059 | Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50060 | Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50061 | Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50062 | Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50063 | Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-50064 | Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog. | HIGH | 7.3 | 0.1% | 47 |
No patch
|