# Siemens PSS SINCAL WibuKey DoS Flaw

Published: 2026-10-22 · Severity: routine · Sectors: Energy, Manufacturing, Transportation, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/22f0b1d6-ad82-5af9-875b-e551ea3289c2/siemens-pss-sincal-wibukey-dos-flaw

> An out-of-bounds write in the WibuKey licensing component used by Siemens PSS SINCAL can crash the system when legacy dongle licensing is configured.

Siemens has disclosed a vulnerability (CVE-2026-84854) affecting its PSS(R)SINCAL power system analysis software, stemming from a third-party component, WibuKey, used for legacy dongle-based licensing. The flaw is an out-of-bounds write that could be exploited to crash the affected system, resulting in a denial-of-service condition. The issue only impacts installations configured to use the legacy WibuKey dongle license type, not newer licensing mechanisms.

Affected versions include PSS(R)SINCAL V21.5, V22.0, and V22.5 prior to V22.5.5. Siemens is preparing patches and has issued SSA-148322 with mitigation guidance in the interim; this advisory was republished verbatim by CISA as ICSA-26-295-06. There is no indication of active in-the-wild exploitation. The affected software is used in critical infrastructure sectors including Energy, Critical Manufacturing, Transportation, Healthcare, Financial Services and Government, with worldwide deployment.

Defenders using PSS(R)SINCAL with legacy WibuKey dongle licensing should migrate away from the legacy license type where possible, monitor for upcoming Siemens patches, and apply standard ICS network hardening: isolate control system networks from business and internet-facing networks, use firewalls/VPNs for remote access, and follow Siemens' and CISA's defense-in-depth recommendations for industrial control environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-84854

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/22f0b1d6-ad82-5af9-875b-e551ea3289c2/siemens-pss-sincal-wibukey-dos-flaw.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup