# Siemens SIMATIC Flaws Allow Remote Code Execution

Published: 2026-11-10 · Severity: severe · Sectors: Manufacturing, Energy, Infrastructure
Canonical: https://vorant.io/reports/86083be4-b28a-5bb4-bd6d-287cc750da6b/siemens-simatic-flaws-allow-remote-code-execution
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns of multiple vulnerabilities in Siemens SIMATIC products enabling remote code execution and security policy bypass; some unpatched.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1495

## What to check

- Applies to: The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-111497 as exploited in the wild.

CERT-FR has published an advisory detailing multiple vulnerabilities affecting a broad range of Siemens SIMATIC industrial automation products, including SIMATIC BATCH, BRAUMAT, Information Server, PCS 7, Process Historian, Profiling Tool, SISTAR, WinCC (multiple versions including Companion, OA, Runtime Professional, and Unified), and WinCC for Industrial Edge. The vulnerabilities, tracked as CVE-2026-58114, CVE-2026-111497, and CVE-2026-59082, allow an attacker to achieve remote arbitrary code execution and bypass security policies.

Notably, Siemens has indicated that several affected products — including SIMATIC BATCH V9.1, Information Server 2020/2022, PCS 7 V9.1, Process Historian 2020/2022, Profiling Tool, and WinCC Companion — will not receive security patches for CVE-2026-58114 or CVE-2026-111497, meaning these products will remain permanently vulnerable unless retired or mitigated through compensating controls (network segmentation, restricted access). Other products, such as SIMATIC BRAUMAT, SISTAR, and WinCC OA V3.20, have fixed versions available (e.g., 3.20 P17.1 or later).

Defenders operating Siemens SIMATIC environments, common in industrial control system (ICS) and manufacturing/energy settings, should consult the three referenced Siemens security bulletins (SSA-242944, SSA-970803, SSA-979641) to determine exact product/version applicability per CVE, apply available patches where offered, and implement network isolation or compensating controls for products that will not receive fixes. No in-the-wild exploitation is mentioned in this advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (KEV), CVE-2026-58114, CVE-2026-59082

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1495

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/86083be4-b28a-5bb4-bd6d-287cc750da6b/siemens-simatic-flaws-allow-remote-code-execution.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup