Siemens Teamcenter XSS, hardcoded credentials, PDF.js flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three vulnerabilities in Siemens Teamcenter V2312–V2512 allow XSS, credential compromise, and arbitrary JS execution; patches available.
Siemens Teamcenter is affected by three vulnerabilities affecting versions V2312 through V2512. CVE-2026-33862 is a cross-site scripting (XSS) flaw resulting from improper encoding of user-supplied data, allowing attackers to inject malicious code executed by other users visiting affected pages. CVE-2026-33893 stems from hardcoded obfuscation keys embedded in the application, potentially enabling attackers to extract and misuse these credentials for unauthorized access. CVE-2024-4367 relates to a missing type check in PDF.js font handling, permitting arbitrary JavaScript execution within the PDF.js context.
Affected versions span multiple releases: V2312 (prior to 0014), V2406 (prior to 0012), V2412 (prior to 0009), and V2506 (prior to 0005). V2512 is affected by the first two CVEs with all versions requiring patching. Siemens has released updates for each affected version stream. The vulnerabilities were reported by researchers at usd AG. No indication of active in-the-wild exploitation is provided in the advisory.
Mentioned in this report
Detection guidance
Cross-Site Scripting Payload in Web Request Query String
Detects reflected XSS payloads (script tags, event handlers, javascript: URIs, plain or URL-encoded) in web server request query strings, as would be used against an XSS flaw in a public-facing app such as Siemens Teamcenter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cross-Site Scripting Payload in Web Request Query String
id: 2e35a691-ebb8-57f5-ba13-438feb3971ed
status: experimental
description: 'Detects common XSS payload constructs (script/svg/img tags, inline event
handlers, javascript: URIs, raw or URL-encoded) in request query strings sent to
web servers. Relevant to exploitation of improper output encoding flaws in public-facing
applications such as Siemens Teamcenter (CVE-2026-33862). The advisory gives no
endpoint or parameter, so this rule matches the generic payload pattern; scope it
to Teamcenter web tier hosts where possible.'
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1539
logsource:
category: webserver
detection:
selection_tags:
cs-uri-query|contains:
- <script
- '%3Cscript'
- <svg
- '%3Csvg'
- <img
- '%3Cimg'
selection_handlers:
cs-uri-query|contains:
- onerror=
- onload=
- onmouseover=
- 'javascript:'
condition: 1 of selection_*
falsepositives:
- Authorized web application vulnerability scanners or penetration tests against the
application
- Applications that legitimately pass HTML snippets in query parameters, such as rich-text
preview endpoints
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs