# Siemens Advisory Covers Broad ICS Product Line

Published: 2026-10-13 · Severity: elevated · Sectors: Manufacturing, Energy, Infrastructure
Canonical: https://vorant.io/reports/6356cdde-f2cb-59c1-b61a-cfc381118a03/siemens-advisory-covers-broad-ics-product-line
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> NCSC-NL relayed a Siemens security advisory listing vulnerabilities across SIMATIC PLCs, Desigo controllers, RUGGEDCOM, WinCC and Industrial Edge products.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0415.html

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2025-6965 (poc); no exploitation in the wild is recorded.

This is a Dutch NCSC advisory (NCSC-2026-0415) republishing a Siemens security bulletin that enumerates an extremely broad set of affected products, spanning SIMATIC S7-1500 and ET 200SP PLCs and software controllers, SIPLUS ruggedized variants, SIMATIC WinCC HMI/SCADA software, SIMATIC IPC industrial PCs, SIMATIC PLCSIM Advanced, Industrial Edge App Publisher and Device Kits, RUGGEDCOM CROSSBOW network management and its Station Access Controller, Desigo building-automation controllers (PXC/PXM series), PSS SINCAL grid-analysis software, SENTRON 3NA COM Fuse, SIDIS Prime, and the .NET Client Library for the SIMATIC S7 Webserver API. The provided text is essentially a product-affected list without accompanying CVE identifiers, vulnerability descriptions, exploitability details, or confirmation of in-the-wild exploitation.

Because no specific flaw descriptions, CVSS scores, attack vectors, or exploitation status were included in this excerpt, defenders cannot determine from this alone whether the issues are remotely exploitable, require authentication, or are already being abused. Given the breadth of affected lines -- covering core PLC firmware, HMI/SCADA software, building automation controllers, and OT network management tooling -- organizations running any of these product families should treat this as a routine but wide-reaching Siemens patch cycle and consult the full Siemens ProductCERT advisory (and its CVE-level detail) for applicability, CVSS scoring, and remediation versions.

Recommended actions: inventory all Siemens SIMATIC, Desigo, RUGGEDCOM, Industrial Edge, PSS SINCAL, SENTRON and SIDIS deployments; cross-reference installed firmware/software versions against the Siemens advisory's fixed versions; prioritize internet- or IT-network-exposed engineering stations, WinCC servers, and Industrial Edge devices for patching; and apply standard ICS segmentation and network-access controls pending patch deployment, since no in-the-wild exploitation was indicated in the material provided.

## Mentioned in this report

- Vulnerabilities: CVE-2024-7322, CVE-2025-6965 (poc), CVE-2025-70873, CVE-2025-71316, CVE-2026-10207, CVE-2026-11822, CVE-2026-11824, CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920, CVE-2026-44414, CVE-2026-44415, CVE-2026-59241, CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357, CVE-2026-72895, CVE-2026-78556, CVE-2026-78557, CVE-2026-84854, CVE-2026-85114, CVE-2026-85115, CVE-2026-89196, CVE-2026-89197, CVE-2026-89198, CVE-2026-89199, CVE-2026-89200, CVE-2026-89201, CVE-2026-89202, CVE-2026-89203, CVE-2026-89204, CVE-2026-89205, CVE-2026-89206

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0415.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6356cdde-f2cb-59c1-b61a-cfc381118a03/siemens-advisory-covers-broad-ics-product-line.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup