Siemens Industrial Edge devices path traversal flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Siemens patched two path traversal vulnerabilities in Industrial Edge devices and SIMATIC/SCALANCE HMI products allowing authenticated attackers to access sensitive internal data.
CISA republished a Siemens ProductCERT advisory (SSA-832641) describing two path traversal vulnerabilities affecting a broad range of Siemens Industrial Edge products. CVE-2026-44414 impacts Industrial Edge Cloud/Own/Virtual Devices, SCALANCE LPE9413/LPE9433, SIMATIC IoT2050 devices, and various SIMATIC IPC Industrial Edge Devices, with a CVSS v3 score of 9.1. CVE-2026-44415 affects a large family of SIMATIC and SIPLUS HMI MTP Unified Comfort Panel and Comfort Pro products. Both flaws stem from improper limitation of pathnames ('.../...//' style traversal) that could allow an authenticated remote attacker to access sensitive internal information outside the intended directory scope.
Siemens has released fixed versions for several affected products and recommends updating to the latest release; fixes for remaining products are still in preparation, with interim mitigations recommended. There is no indication in the advisory of active exploitation in the wild. Affected sectors span critical manufacturing, transportation, energy, healthcare, financial services, and government facilities, with deployments worldwide.
Defenders operating Siemens Industrial Edge or affected HMI/IPC hardware should inventory devices against the listed model numbers and firmware versions, apply vendor patches where available, and in the interim restrict network exposure of control system devices, isolate them behind firewalls from business networks, and require VPN access for remote management per Siemens' and CISA's standard ICS hardening guidance.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs