Siemens Patches Mass SIMATIC, WinCC, SCALANCE Flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Siemens disclosed dozens of vulnerabilities across SIMATIC S7-1500, WinCC, SCALANCE, HMI and IPC products enabling RCE, privilege escalation and DoS; one Desigo flaw has no patch.
CERT-FR relayed nine Siemens ProductCERT security advisories (SSA bulletins dated 13 October 2026) covering a broad swath of the Siemens industrial automation portfolio. Affected product families include Desigo PXC/PXM building automation controllers, SCALANCE LPE9413/LPE9433 industrial PCs, SIMATIC Drive Controllers (CPU 1504D/1507D TF), the SIMATIC ET 200SP CPU family and Open Controllers, the SIMATIC S7 PLC web server and Webserver API, SIMATIC S7-1500 CPUs and the TM MFP module, SIMATIC HMI Comfort/Unified Comfort Panels across the MTP700-MTP2200 range, SIMATIC IoT2050/IPC industrial edge devices, and SIMATIC WinCC versions 7.5, 8.0 and 8.1. Collectively the advisories enumerate several hundred CVEs, the large majority stemming from third-party and embedded Linux kernel components bundled in the S7-1500 firmware and TM MFP module, alongside a smaller set of Siemens-specific flaws (CVE-2026-89208, CVE-2026-44414, CVE-2026-44415, CVE-2026-59241, and the CVE-2026-63350 through CVE-2026-63357 cluster affecting the S7 web server and multiple ET200SP/Drive Controller CPUs).
Impacts described by the vendor span remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality loss, security policy bypass and reflected/indirect code injection (XSS). Siemens states that Desigo PXC/PXM (versions ≥2.3) will not receive a fix for CVE-2026-89208, leaving that product permanently exposed absent compensating controls. No indication of active in-the-wild exploitation is given in this bulletin; it is a vendor patch disclosure rather than an incident report.
Defenders operating Siemens ICS/OT equipment should inventory affected part numbers and firmware versions against the per-product list, prioritize patching the SIMATIC S7-1500/Drive Controller/ET200SP web-server CVEs and the WinCC updates (8.0.0.11, 8.1.7), and apply Siemens' standard OT network-segmentation and restricted web-server-access guidance for Desigo PXC/PXM where no patch exists. Given the scale of affected control and HMI hardware in manufacturing and critical-infrastructure environments, review of exposure (especially web-server interfaces reachable from IT networks) is recommended even without evidence of exploitation.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1298
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs