Siemens PSS SINCAL WibuKey DoS Flaw
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
An out-of-bounds write in the WibuKey licensing component used by Siemens PSS SINCAL can crash the system when legacy dongle licensing is configured.
Siemens has disclosed a vulnerability (CVE-2026-84854) affecting its PSS(R)SINCAL power system analysis software, stemming from a third-party component, WibuKey, used for legacy dongle-based licensing. The flaw is an out-of-bounds write that could be exploited to crash the affected system, resulting in a denial-of-service condition. The issue only impacts installations configured to use the legacy WibuKey dongle license type, not newer licensing mechanisms.
Affected versions include PSS(R)SINCAL V21.5, V22.0, and V22.5 prior to V22.5.5. Siemens is preparing patches and has issued SSA-148322 with mitigation guidance in the interim; this advisory was republished verbatim by CISA as ICSA-26-295-06. There is no indication of active in-the-wild exploitation. The affected software is used in critical infrastructure sectors including Energy, Critical Manufacturing, Transportation, Healthcare, Financial Services and Government, with worldwide deployment.
Defenders using PSS(R)SINCAL with legacy WibuKey dongle licensing should migrate away from the legacy license type where possible, monitor for upcoming Siemens patches, and apply standard ICS network hardening: isolate control system networks from business and internet-facing networks, use firewalls/VPNs for remote access, and follow Siemens' and CISA's defense-in-depth recommendations for industrial control environments.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs