# Siemens Teamcenter XSS, hardcoded credentials, PDF.js flaws

Published: 2026-05-14 · Severity: high · Sectors: manufacturing
Canonical: https://vorant.io/reports/c51b7e14-8ade-5d1b-ab63-efaedf2e4a87/siemens-teamcenter-xss-hardcoded-credentials-pdf-js-flaws

> Three vulnerabilities in Siemens Teamcenter V2312–V2512 allow XSS, credential compromise, and arbitrary JS execution; patches available.

Siemens Teamcenter is affected by three vulnerabilities affecting versions V2312 through V2512. CVE-2026-33862 is a cross-site scripting (XSS) flaw resulting from improper encoding of user-supplied data, allowing attackers to inject malicious code executed by other users visiting affected pages. CVE-2026-33893 stems from hardcoded obfuscation keys embedded in the application, potentially enabling attackers to extract and misuse these credentials for unauthorized access. CVE-2024-4367 relates to a missing type check in PDF.js font handling, permitting arbitrary JavaScript execution within the PDF.js context.

Affected versions span multiple releases: V2312 (prior to 0014), V2406 (prior to 0012), V2412 (prior to 0009), and V2506 (prior to 0005). V2512 is affected by the first two CVEs with all versions requiring patching. Siemens has released updates for each affected version stream. The vulnerabilities were reported by researchers at usd AG. No indication of active in-the-wild exploitation is provided in the advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2024-4367 (poc), CVE-2026-33862, CVE-2026-33893

## Detection guidance (public sample)

### Cross-Site Scripting Payload in Web Request Query String

ATT&CK: T1190

Detects reflected XSS payloads (script tags, event handlers, javascript: URIs, plain or URL-encoded) in web server request query strings, as would be used against an XSS flaw in a public-facing app such as Siemens Teamcenter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cross-Site Scripting Payload in Web Request Query String
id: 2e35a691-ebb8-57f5-ba13-438feb3971ed
status: experimental
description: 'Detects common XSS payload constructs (script/svg/img tags, inline event
  handlers, javascript: URIs, raw or URL-encoded) in request query strings sent to
  web servers. Relevant to exploitation of improper output encoding flaws in public-facing
  applications such as Siemens Teamcenter (CVE-2026-33862). The advisory gives no
  endpoint or parameter, so this rule matches the generic payload pattern; scope it
  to Teamcenter web tier hosts where possible.'
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1539
logsource:
  category: webserver
detection:
  selection_tags:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - <svg
    - '%3Csvg'
    - <img
    - '%3Cimg'
  selection_handlers:
    cs-uri-query|contains:
    - onerror=
    - onload=
    - onmouseover=
    - 'javascript:'
  condition: 1 of selection_*
falsepositives:
- Authorized web application vulnerability scanners or penetration tests against the
  application
- Applications that legitimately pass HTML snippets in query parameters, such as rich-text
  preview endpoints
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c51b7e14-8ade-5d1b-ab63-efaedf2e4a87/siemens-teamcenter-xss-hardcoded-credentials-pdf-js-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup