Siemens SIMATIC WinCC and Process Historian: flaws CVE-2026-58114, CVE-2026-111497 and CVE-2026-59082, some without fix
Siemens published three security bulletins on 10 November 2026 (SSA-242944, SSA-970803 and SSA-979641) covering several flaws in SIMATIC industrial automation and HMI software, which CERT-FR says could allow remote arbitrary code execution and a security policy bypass. Three CVEs are concerned: CVE-2026-58114, CVE-2026-111497 and CVE-2026-59082, and the article does not state which flaw causes which impact or what the attack prerequisites are. According to the article, Siemens will not provide a security fix for CVE-2026-58114 in SIMATIC BATCH V9.1, PCS 7 V9.1, Information Server 2020 and 2022, Process Historian 2020 and 2022, and WinCC Runtime Professional V17 to V21, nor for CVE-2026-111497 in SIMATIC Profiling Tool. The article gives no exploitation status and no CVSS score, and it does not name the finder. Urgency is rated high because the Siemens CNA record for CVE-2026-58114 scores it 7.5 (CVSS 3.1) and 7.7 (CVSS 4.0) with a network vector and no privileges required, although user interaction is required in the 4.0 vector and no exploit is listed (cve.org, vuldb.com).
Entenda a falha
A vulnerabilidade
Siemens published bulletins SSA-242944, SSA-970803 and SSA-979641 on 10 November 2026 for three flaws in SIMATIC software. CERT-FR says they allow remote arbitrary code execution and a security policy bypass, without saying which CVE causes which. CVE-2026-58114 is the most documented: a weak authentication flaw (CWE-1390) in SIMATIC BATCH, PCS 7, Information Server, Process Historian, WinCC and WinCC Runtime Professional V17 to V21. It is rated CVSS 3.1 7.5 and CVSS 4.0 7.7, with a network vector, no privileges and user interaction required. CVE-2026-111497 affects SIMATIC Profiling Tool, WinCC Companion, WinCC OA V3.21, WinCC Unified and WinCC Runtime Professional. CVE-2026-59082 affects WinCC V7.5, V8.0 and V8.1. No details are given for either of these two, and other sources tie CVE-2026-111497 to a Node.js Brotli bug, so its SIMATIC mapping is unconfirmed. Siemens will not fix CVE-2026-58114 in BATCH V9.1, PCS 7 V9.1, Information Server 2020/2022, Process Historian 2020/2022 and WinCC Runtime Professional V17 to V21, nor CVE-2026-111497 in the Profiling Tool. The version ranges imply BRAUMAT and SISTAR are fixed from 8.2.0.5 and WinCC OA V3.20 from 3.20 P17.1.
Como funciona
The articles do not describe the vulnerable process step by step. For CVE-2026-58114, the records only say the flaw is in authentication and is reachable over the network without prior privileges, and that the CVSS 4.0 vector needs some user interaction. They give no information on the internal mechanism of CVE-2026-111497 or CVE-2026-59082.
Por que é vulnerável
For CVE-2026-58114 the root cause is classified as weak authentication (CWE-1390), and VulDB calls it improper authentication. The articles do not explain the exact missing check or why it went unnoticed. For the other two CVEs no cause is given. For the products Siemens will not fix, there is no fix to describe.
Como foi descoberta
The articles do not name who found the flaws or how. Siemens published the three bulletins on 10 November 2026 and CERT-FR issued its advisory the same day, referring readers to Siemens for the patches. Siemens is the CNA for CVE-2026-58114, and no exploitation in the wild is reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:42.
Detalhes técnicos
CVE-2026-58114 is a weak authentication flaw (CWE-1390) published by Siemens as CNA on 10 November 2026. Its CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.5), and its CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (score 7.7) (cve.org). VulDB describes it as improper authentication in SIMATIC Batch, Information Server, PCS 7, Process Historian, WinCC and WinCC Runtime Professional, and states that no exploit is available (vuldb.com). The article lists affected SIMATIC lines for each of the three CVEs but gives no vector, CWE or score for CVE-2026-111497 or CVE-2026-59082, and no primary record for CVE-2026-59082 was opened.
Remediação
For the lines the article lists without a fix, the vendor states that no patch will be released, so defenders should isolate those systems, restrict network access to the affected services and plan a move to a supported version. For the other lines, apply the fixes in Siemens bulletins SSA-242944, SSA-970803 and SSA-979641; those pages could not be opened, so the fixed versions are not confirmed here. The article's version ranges imply 8.2.0.5 as the first unaffected version for SIMATIC BRAUMAT and SISTAR, and 3.20 P17.1 for the WinCC OA V3.20 branch. The article itself refers readers to the Siemens bulletins for the patches.
Relatos divergentes
The article and Siemens's listing tie CVE-2026-111497 to SIMATIC products. Other sources describe the same identifier as an out-of-bounds write in the Node.js Brotli decoder, fixed in Node.js security releases of 21 October 2026, and one write-up gives it a 9.2 score (akamai.com, herodevs.com, explore.alas.aws.amazon.com). The CVE record for CVE-2026-111497 could not be retrieved because the cve.org page requires JavaScript, so this identifier's mapping to SIMATIC is unconfirmed and should be checked against the CVE record before it is relied upon.
Linha do tempo
-
Siemens SIMATIC WinCC and Process Historian: flaws CVE-2026-58114, CVE-2026-111497 and CVE-2026-59082, some without fix
ler a análise desta fonte ocultar
Siemens published three security bulletins on 10 November 2026 (SSA-242944, SSA-970803 and SSA-979641) covering several flaws in SIMATIC industrial automation and HMI software, which CERT-FR says could allow remote arbitrary code execution and a security policy bypass. Three CVEs are concerned: CVE-2026-58114, CVE-2026-111497 and CVE-2026-59082, and the article does not state which flaw causes which impact or what the attack prerequisites are. According to the article, Siemens will not provide a security fix for CVE-2026-58114 in SIMATIC BATCH V9.1, PCS 7 V9.1, Information Server 2020 and 2022, Process Historian 2020 and 2022, and WinCC Runtime Professional V17 to V21, nor for CVE-2026-111497 in SIMATIC Profiling Tool. The article gives no exploitation status and no CVSS score, and it does not name the finder. Urgency is rated high because the Siemens CNA record for CVE-2026-58114 scores it 7.5 (CVSS 3.1) and 7.7 (CVSS 4.0) with a network vector and no privileges required, although user interaction is required in the 4.0 vector and no exploit is listed (cve.org, vuldb.com).
Technical Details
CVE-2026-58114 is a weak authentication flaw (CWE-1390) published by Siemens as CNA on 10 November 2026. Its CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.5), and its CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (score 7.7) (cve.org). VulDB describes it as improper authentication in SIMATIC Batch, Information Server, PCS 7, Process Historian, WinCC and WinCC Runtime Professional, and states that no exploit is available (vuldb.com). The article lists affected SIMATIC lines for each of the three CVEs but gives no vector, CWE or score for CVE-2026-111497 or CVE-2026-59082, and no primary record for CVE-2026-59082 was opened.
Remediation
For the lines the article lists without a fix, the vendor states that no patch will be released, so defenders should isolate those systems, restrict network access to the affected services and plan a move to a supported version. For the other lines, apply the fixes in Siemens bulletins SSA-242944, SSA-970803 and SSA-979641; those pages could not be opened, so the fixed versions are not confirmed here. The article's version ranges imply 8.2.0.5 as the first unaffected version for SIMATIC BRAUMAT and SISTAR, and 3.20 P17.1 for the WinCC OA V3.20 branch. The article itself refers readers to the Siemens bulletins for the patches.
Conflicting Reports
The article and Siemens's listing tie CVE-2026-111497 to SIMATIC products. Other sources describe the same identifier as an out-of-bounds write in the Node.js Brotli decoder, fixed in Node.js security releases of 21 October 2026, and one write-up gives it a 9.2 score (akamai.com, herodevs.com, explore.alas.aws.amazon.com). The CVE record for CVE-2026-111497 could not be retrieved because the cve.org page requires JavaScript, so this identifier's mapping to SIMATIC is unconfirmed and should be checked against the CVE record before it is relied upon.