# Siemens Patches Mass SIMATIC, WinCC, SCALANCE Flaws

Published: 2026-10-13 · Severity: elevated · Sectors: manufacturing, energy, infrastructure
Canonical: https://vorant.io/reports/e97a02b7-6b63-5797-ae14-0157e16e9776/siemens-patches-mass-simatic-wincc-scalance-flaws

> Siemens disclosed dozens of vulnerabilities across SIMATIC S7-1500, WinCC, SCALANCE, HMI and IPC products enabling RCE, privilege escalation and DoS; one Desigo flaw has no patch.

CERT-FR relayed nine Siemens ProductCERT security advisories (SSA bulletins dated 13 October 2026) covering a broad swath of the Siemens industrial automation portfolio. Affected product families include Desigo PXC/PXM building automation controllers, SCALANCE LPE9413/LPE9433 industrial PCs, SIMATIC Drive Controllers (CPU 1504D/1507D TF), the SIMATIC ET 200SP CPU family and Open Controllers, the SIMATIC S7 PLC web server and Webserver API, SIMATIC S7-1500 CPUs and the TM MFP module, SIMATIC HMI Comfort/Unified Comfort Panels across the MTP700-MTP2200 range, SIMATIC IoT2050/IPC industrial edge devices, and SIMATIC WinCC versions 7.5, 8.0 and 8.1. Collectively the advisories enumerate several hundred CVEs, the large majority stemming from third-party and embedded Linux kernel components bundled in the S7-1500 firmware and TM MFP module, alongside a smaller set of Siemens-specific flaws (CVE-2026-89208, CVE-2026-44414, CVE-2026-44415, CVE-2026-59241, and the CVE-2026-63350 through CVE-2026-63357 cluster affecting the S7 web server and multiple ET200SP/Drive Controller CPUs).

Impacts described by the vendor span remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality loss, security policy bypass and reflected/indirect code injection (XSS). Siemens states that Desigo PXC/PXM (versions ≥2.3) will not receive a fix for CVE-2026-89208, leaving that product permanently exposed absent compensating controls. No indication of active in-the-wild exploitation is given in this bulletin; it is a vendor patch disclosure rather than an incident report.

Defenders operating Siemens ICS/OT equipment should inventory affected part numbers and firmware versions against the per-product list, prioritize patching the SIMATIC S7-1500/Drive Controller/ET200SP web-server CVEs and the WinCC updates (8.0.0.11, 8.1.7), and apply Siemens' standard OT network-segmentation and restricted web-server-access guidance for Desigo PXC/PXM where no patch exists. Given the scale of affected control and HMI hardware in manufacturing and critical-infrastructure environments, review of exposure (especially web-server interfaces reachable from IT networks) is recommended even without evidence of exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2021-41617, CVE-2024-50063, CVE-2024-56719, CVE-2025-40135, CVE-2025-68206, CVE-2026-23113, CVE-2026-27135, CVE-2026-40355, CVE-2026-41989, CVE-2026-43303, CVE-2026-44414, CVE-2026-44415, CVE-2026-46172, CVE-2026-53218, CVE-2026-59241, CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357, CVE-2026-64560, CVE-2026-89208

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1298

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e97a02b7-6b63-5797-ae14-0157e16e9776/siemens-patches-mass-simatic-wincc-scalance-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup