Siemens SINEC INS flaws enable RCE and privilege escalation
Siemens SINEC INS versions before 1.0 SP2 Update 6 contain critical command injection, path traversal, privilege escalation, and weak password hashing vulnerabilities affecting industrial control systems worldwide.
CISA has published an ICS advisory detailing four vulnerabilities in Siemens SINEC INS, an industrial network security appliance deployed globally across critical infrastructure sectors including manufacturing, energy, healthcare, and transportation. The most severe flaw (CVE-2026-46746) is an authenticated OS command injection vulnerability in the /api/sftp/uploadFiles endpoint that allows remote attackers to execute arbitrary commands with sinecins service user privileges by injecting shell payloads via crafted directory names. Additional vulnerabilities include a path traversal flaw (CVE-2026-46747) enabling unauthorized file system access, a local privilege escalation issue (CVE-2026-46748) stemming from misconfigured Linux capabilities allowing root access, and weak password hashing (CVE-2026-46749) using hardcoded salts that facilitate credential recovery attacks.
All vulnerabilities affect SINEC INS versions prior to 1.0.2.6. Siemens has released version 1.0 SP2 Update 6 to address these issues and strongly recommends immediate patching. The advisory was reported by Siemens ProductCERT and republished by CISA from the vendor's CSAF format. Organizations running affected versions should prioritize updates and implement defense-in-depth measures including network segmentation, firewall protection, and restricted remote access to minimize exploitation risk.
Mentioned in this report
Detection guidance
Suspicious Shell Execution from SINEC INS SFTP Upload Service
Detects a shell interpreter spawned as a child of the SINEC INS (sinecins) service process, consistent with OS command injection via the /api/sftp/uploadFiles directory name parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Execution from SINEC INS SFTP Upload Service
id: 03989ea7-898b-5ae0-b46e-d7bb4db1ad24
status: experimental
description: Detects a shell interpreter (sh, bash, dash) spawned as a child of the
SINEC INS backend/service process, which is consistent with exploitation of CVE-2026-46746,
an OS command injection in the /api/sftp/uploadFiles endpoint that executes attacker
payloads with sinecins service user privileges.
references:
- CISA ICS Advisory Siemens SINEC INS (CVE-2026-46746)
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- sinecins
- sinec-ins
- sinec_ins
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
selection_shellmeta:
CommandLine|contains:
- ;
- '|'
- '`'
- $(
- '&&'
condition: selection_parent and selection_child and selection_shellmeta
falsepositives:
- Legitimate maintenance scripts invoked by the SINEC INS service that legitimately
shell out for administrative tasks
- Backup or monitoring agents that wrap the sinecins service process and legitimately
invoke shell utilities
level: high
tags:
- attack.t1059
- attack.execution
- cve.2026-46746
Path Traversal or Command Injection Attempt Against SINEC INS SFTP Upload Endpoint
Detects HTTP requests to the SINEC INS /api/sftp/uploadFiles endpoint containing path traversal sequences or shell metacharacters in parameters, indicating exploitation attempts of CVE-2026-46746/46747. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal or Command Injection Attempt Against SINEC INS SFTP Upload Endpoint
id: 7216d595-629d-57b9-be00-7677c5ef045e
status: experimental
description: Detects HTTP requests to the SINEC INS /api/sftp/uploadFiles API endpoint
that contain directory traversal sequences or shell metacharacters within the request
path or parameters, consistent with exploitation of the authenticated OS command
injection (CVE-2026-46746) or path traversal (CVE-2026-46747) vulnerabilities.
references:
- CISA ICS Advisory Siemens SINEC INS (CVE-2026-46746, CVE-2026-46747)
author: Vorant
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains: /api/sftp/uploadFiles
selection_traversal:
cs-uri-query|contains:
- ../
- ..%2f
- ..%5c
selection_injection:
cs-uri-query|contains:
- ;
- '|'
- '`'
- $(
- '&&'
condition: selection_endpoint and (selection_traversal or selection_injection)
falsepositives:
- Automated security scanners or penetration test tools probing the SINEC INS web
interface
- Legitimate file uploads that unintentionally include special characters in directory
names
level: high
tags:
- attack.t1083
- attack.discovery
- cve.2026-46746
- cve.2026-46747
Privilege Escalation via Capability-Enabled SINEC INS Binary Spawning Root Process
Detects a low-privileged sinecins service process unexpectedly spawning a process running as root or invoking setcap/getcap, consistent with abuse of misconfigured Linux capabilities (CVE-2026-46748) to escalate privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Privilege Escalation via Capability-Enabled SINEC INS Binary Spawning Root
Process
id: c1b84e96-2b89-549d-90b7-8094d724245d
status: experimental
description: Detects a process running under the sinecins service context that inspects
or leverages Linux file capabilities (setcap/getcap/capsh) or spawns a subsequent
process running as root/UID 0, which may indicate exploitation of CVE-2026-46748,
a local privilege escalation caused by misconfigured Linux capabilities on SINEC
INS.
references:
- CISA ICS Advisory Siemens SINEC INS (CVE-2026-46748)
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- sinecins
- sinec-ins
- sinec_ins
selection_capcmd:
Image|endswith:
- /setcap
- /getcap
- /capsh
selection_rootspawn:
User: root
condition: selection_parent and (selection_capcmd or selection_rootspawn)
falsepositives:
- Legitimate configuration or installer scripts that set required capabilities on
the sinecins binary during deployment or upgrade
- System administrators manually auditing capabilities on service binaries
level: medium
tags:
- attack.t1078
- attack.privilege_escalation
- attack.t1574
- cve.2026-46748
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-04
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free