Siemens SIMATIC Flaws Allow Remote Code Execution
CERT-FR warns of multiple vulnerabilities in Siemens SIMATIC products enabling remote code execution and security policy bypass; some unpatched.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-111497 as exploited in the wild.
CERT-FR has published an advisory detailing multiple vulnerabilities affecting a broad range of Siemens SIMATIC industrial automation products, including SIMATIC BATCH, BRAUMAT, Information Server, PCS 7, Process Historian, Profiling Tool, SISTAR, WinCC (multiple versions including Companion, OA, Runtime Professional, and Unified), and WinCC for Industrial Edge. The vulnerabilities, tracked as CVE-2026-58114, CVE-2026-111497, and CVE-2026-59082, allow an attacker to achieve remote arbitrary code execution and bypass security policies.
Notably, Siemens has indicated that several affected products — including SIMATIC BATCH V9.1, Information Server 2020/2022, PCS 7 V9.1, Process Historian 2020/2022, Profiling Tool, and WinCC Companion — will not receive security patches for CVE-2026-58114 or CVE-2026-111497, meaning these products will remain permanently vulnerable unless retired or mitigated through compensating controls (network segmentation, restricted access). Other products, such as SIMATIC BRAUMAT, SISTAR, and WinCC OA V3.20, have fixed versions available (e.g., 3.20 P17.1 or later).
Defenders operating Siemens SIMATIC environments, common in industrial control system (ICS) and manufacturing/energy settings, should consult the three referenced Siemens security bulletins (SSA-242944, SSA-970803, SSA-979641) to determine exact product/version applicability per CVE, apply available patches where offered, and implement network isolation or compensating controls for products that will not receive fixes. No in-the-wild exploitation is mentioned in this advisory.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1495
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs