SIMATIC WinCC flaw lets database users run host commands
WinCC V7.5 has no fix; V8.0 and V8.1 are fixed in Update 11 and Update 7.
64
Vulnerability1 · 1 read
CVE-2026-59241
Database-role privilege escalation in Siemens SIMATIC WinCC
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens SIMATIC WinCC assigns overly broad permissions to a database role (CWE-266). An authenticated remote attacker who already has database access can use that role to escalate privileges and run arbitrary commands on the Windows host where WinCC is installed, which can fully compromise the system. All versions of WinCC V7.5 are affected, as are V8.0 before Update 11 and V8.1 before Update 7. CVSS 4.0 rates the issue 8.7 (high). It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade SIMATIC WinCC V8.0 to Update 11 or later and V8.1 to Update 7 or later. No fixed release is listed for V7.5, so follow Siemens guidance for that line, restrict who can authenticate to the WinCC database, and keep WinCC hosts off untrusted networks.
| Product | Affected |
|---|---|
| Siemens SIMATIC WinCC V7.5 | All versions |
| Siemens SIMATIC WinCC V8.0 | All versions before V8.0 Update 11 |
| Siemens SIMATIC WinCC V8.1 | All versions before V8.1 Update 7 |
Estimated exposure
moderatetens of thousands of industrial installations (order-of-magnitude estimate; exact count unknown) — SIMATIC WinCC is a widely used Siemens HMI/SCADA product in industrial plants, but there is no public install census or scan count in the CVE data, and deployments are typically not meant to be internet-facing.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.
- Weakness
- CWE-266
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X