Siemens SINEC INS flaws enable RCE and privilege escalation
Siemens SINEC INS versions before 1.0 SP2 Update 6 contain critical command injection, path traversal, privilege escalation, and weak password hashing vulnerabilities affecting industrial control systems worldwide.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an ICS advisory detailing four vulnerabilities in Siemens SINEC INS, an industrial network security appliance deployed globally across critical infrastructure sectors including manufacturing, energy, healthcare, and transportation. The most severe flaw (CVE-2026-46746) is an authenticated OS command injection vulnerability in the /api/sftp/uploadFiles endpoint that allows remote attackers to execute arbitrary commands with sinecins service user privileges by injecting shell payloads via crafted directory names. Additional vulnerabilities include a path traversal flaw (CVE-2026-46747) enabling unauthorized file system access, a local privilege escalation issue (CVE-2026-46748) stemming from misconfigured Linux capabilities allowing root access, and weak password hashing (CVE-2026-46749) using hardcoded salts that facilitate credential recovery attacks.
All vulnerabilities affect SINEC INS versions prior to 1.0.2.6. Siemens has released version 1.0 SP2 Update 6 to address these issues and strongly recommends immediate patching. The advisory was reported by Siemens ProductCERT and republished by CISA from the vendor's CSAF format. Organizations running affected versions should prioritize updates and implement defense-in-depth measures including network segmentation, firewall protection, and restricted remote access to minimize exploitation risk.
Mentioned in this report
Detection guidance
Suspicious Shell Execution from SINEC INS SFTP Upload Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell interpreter spawned as a child of the SINEC INS (sinecins) service process, consistent with OS command injection via the /api/sftp/uploadFiles directory name parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Execution from SINEC INS SFTP Upload Service
id: 03989ea7-898b-5ae0-b46e-d7bb4db1ad24
status: experimental
description: Detects a shell interpreter (sh, bash, dash) spawned as a child of the
SINEC INS backend/service process, which is consistent with exploitation of CVE-2026-46746,
an OS command injection in the /api/sftp/uploadFiles endpoint that executes attacker
payloads with sinecins service user privileges.
references:
- CISA ICS Advisory Siemens SINEC INS (CVE-2026-46746)
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- sinecins
- sinec-ins
- sinec_ins
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
selection_shellmeta:
CommandLine|contains:
- ;
- '|'
- '`'
- $(
- '&&'
condition: selection_parent and selection_child and selection_shellmeta
falsepositives:
- Legitimate maintenance scripts invoked by the SINEC INS service that legitimately
shell out for administrative tasks
- Backup or monitoring agents that wrap the sinecins service process and legitimately
invoke shell utilities
level: high
tags:
- attack.t1059
- attack.execution
- cve.2026-46746
Path Traversal or Command Injection Attempt Against SINEC INS SFTP Upload Endpoint
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the SINEC INS /api/sftp/uploadFiles endpoint containing path traversal sequences or shell metacharacters in parameters, indicating exploitation attempts of CVE-2026-46746/46747. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal or Command Injection Attempt Against SINEC INS SFTP Upload Endpoint
id: 7216d595-629d-57b9-be00-7677c5ef045e
status: experimental
description: Detects HTTP requests to the SINEC INS /api/sftp/uploadFiles API endpoint
that contain directory traversal sequences or shell metacharacters within the request
path or parameters, consistent with exploitation of the authenticated OS command
injection (CVE-2026-46746) or path traversal (CVE-2026-46747) vulnerabilities.
references:
- CISA ICS Advisory Siemens SINEC INS (CVE-2026-46746, CVE-2026-46747)
author: Vorant
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /api/sftp/uploadFiles
selection_traversal:
cs-uri-query|contains:
- ../
- ..%2f
- ..%5c
selection_injection:
cs-uri-query|contains:
- ;
- '|'
- '`'
- $(
- '&&'
condition: selection_endpoint and (selection_traversal or selection_injection)
falsepositives:
- Automated security scanners or penetration test tools probing the SINEC INS web
interface
- Legitimate file uploads that unintentionally include special characters in directory
names
level: high
tags:
- attack.t1083
- attack.discovery
- cve.2026-46746
- cve.2026-46747
Privilege Escalation via Capability-Enabled SINEC INS Binary Spawning Root Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a low-privileged sinecins service process unexpectedly spawning a process running as root or invoking setcap/getcap, consistent with abuse of misconfigured Linux capabilities (CVE-2026-46748) to escalate privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Privilege Escalation via Capability-Enabled SINEC INS Binary Spawning Root
Process
id: c1b84e96-2b89-549d-90b7-8094d724245d
status: experimental
description: Detects a process running under the sinecins service context that inspects
or leverages Linux file capabilities (setcap/getcap/capsh) or spawns a subsequent
process running as root/UID 0, which may indicate exploitation of CVE-2026-46748,
a local privilege escalation caused by misconfigured Linux capabilities on SINEC
INS.
references:
- CISA ICS Advisory Siemens SINEC INS (CVE-2026-46748)
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- sinecins
- sinec-ins
- sinec_ins
selection_capcmd:
Image|endswith:
- /setcap
- /getcap
- /capsh
selection_rootspawn:
User: root
condition: selection_parent and (selection_capcmd or selection_rootspawn)
falsepositives:
- Legitimate configuration or installer scripts that set required capabilities on
the sinecins binary during deployment or upgrade
- System administrators manually auditing capabilities on service binaries
level: medium
tags:
- attack.t1078
- attack.privilege-escalation
- attack.t1574
- cve.2026-46748
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-04
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs