Siemens patches RCE flaws in SIMATIC, Desigo CC
ANSSI advisory covers multiple Siemens SIMATIC HMI/Runtime products and Desigo CC affected by arbitrary code execution and privilege escalation vulnerabilities.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 as exploited in the wild.
ANSSI (CERT-FR) has republished two Siemens security advisories (SSA-328642 and SSA-330084) covering multiple vulnerabilities across a broad range of Siemens industrial products. The flaws, tracked as CVE-2026-31431 and CVE-2026-34223, allow an attacker to achieve arbitrary code execution and privilege escalation. Affected products include Desigo CC building management software (all versions), various SIMATIC AX Runtime Core Linux builds, SIMATIC CN 4100, the SIMATIC IoT2050 Advanced device, SIMATIC Industrial Edge Device OS, SIMATIC S7-1500 TM MFP module, and a large family of SIMATIC HMI MTP unified/comfort panel touch panels (MTP400 through MTP2200 series) running versions prior to 21.0.2.1.
No indication of active exploitation is provided in the advisory; this is a vendor-driven patch notification distributed via the French national CERT. Given the operational technology nature of the affected products (HMI panels, industrial controllers, building management systems), successful exploitation could impact plant floor visibility/control or building automation systems, making timely patching important for asset owners in manufacturing and infrastructure environments. No proof-of-concept exploit, IOCs, or attribution are included; organizations should consult the linked Siemens bulletins for patched versions and apply fixes according to their change-management processes.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1133
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs