Vulnerability in Siemens SIMATIC WinCC V7.5

[ Description ]Official description

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL13 Oct 2026NCSC-2026-0415

  Vulnerabilities fixed in Siemens products Translated from Dutch

  Probability/damage M/HCVE-2024-7322CVE-2025-6965CVE-2025-70873+38 more CVEs
• CERT-FR13 Oct 2026CERTFR-2026-AVI-1298

  Multiple vulnerabilities in Siemens products Translated from French

  Multiple vulnerabilities have been discovered in Siemens products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2021-41617CVE-2023-28531CVE-2023-51384+716 more CVEs
• BSI CERT-Bund12 Oct 2026WID-SEC-2026-3874

  Siemens SIMATIC WinCC: Vulnerability allows privilege escalation Translated from German

  CVE-2026-59241

[ References ]References

• cert-portal.siemens.com/productcert/html/ssa-550198.html