Siemens Mendix SAML module allows assertion-replay login bypass
Unauthenticated attackers can replay a valid IdP-initiated SAML response; fixes are V4.2.4 and V3.6.29.
46
Organization
Siemens ProductCERT
- Mentions · 7d1
- Mentions · 30d8
- All mentions14
- First seenAug 20, 2026
- Last mentioned1d ago
Timeline
14 articles · newest firstSiemens SENTRON 3NA COM Fuse before 5.2 can be forced into DoS
An unsolicited encrypted ZigBee rejoin response can change the node ID; recovery requires rebuilding the network.
42
PSS SINCAL WibuKey flaw can crash systems (CVE-2026-84854)
Only legacy WibuKey dongle licensing is affected; V22.5 is fixed in Update 5, while V21.5 and V22.0 need a manual runtime install.
48
SIMATIC WinCC flaw lets database users run host commands
WinCC V7.5 has no fix; V8.0 and V8.1 are fixed in Update 11 and Update 7.
64
Siemens Capital Embedded AR Classic has remote out-of-bounds read
R20-11 is fixed in V2303, while all 431-422 builds have no planned fix and should stay behind firewalls.
44
Siemens SIMATIC S7 Webserver API vulnerabilities
NET Client Library for SIMATIC S7 Webserver API versions before 3.3.61 and 3.3.62 vulnerable to path traversal and sensitive information exposure; update to 3.3.61 or later.
55
Siemens Software Center before 4.0.9.8 allows local DLL hijack
Siemens says the flaw has known active exploitation and that existing installs auto-update to 4.0.9.8 on next startup.
74
Siemens Software Center DLL sideloading flaw exploited in the wild
CVE-2026-110936 affects Siemens Software Center before V4.0.9.8, and Siemens reports active exploitation.
73
Siemens Mendix Runtime (Update A)
CISA revoked its Siemens Mendix Runtime advisory after CVE-2026-7891 was rejected as expected behavior.
34
Siemens Industrial Edge Management
Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.
74
Siemens Siveillance Control
Siemens Siveillance Control OIS flaw lets low-privilege attackers upload files and gain root.
71
Siemens SIMOVE Fleetmanager and SIPLANT
Siemens patched a high-severity path traversal in SIMOVE Fleetmanager and SIPLANT that can expose secrets.
58
Siemens Desigo CC family
Siemens Desigo CC graphics documents can run attacker scripts and compromise client operating systems.
60
NSA, CISA, FBI, DOE, and EPA Warn of Active AI
Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.
88
Related CVEs
by mentions- CVE-2026-110936<1%8.4DLL Search-Path Hijacking in Siemens Software Center
- CVE-2026-67367<1%9.2Unauthenticated Directory Traversal File Read in Siemens SIMOVE Fleetmanager and SIPLANT
- CVE-2026-7891<1%9.1Rejected reason: This CVE has been retracted
- CVE-2026-50093<1%8.9Arbitrary File Upload in Siemens Siveillance Control OIS Web Module Leads to Root Access
- Path traversal in Siemens .NET SIMATIC S7 Webserver client
- SAML assertion replay in Mendix SAML IdP-initiated login
- Out-of-bounds kernel buffer write in WibuKey Windows driver before 6.72
- A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo…
- A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
- CVE-2024-7322<1%5.8A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes…
Appears with
- Siemensvendor · 14
- CISAorganization · 13
- Siemens Software Centerproduct · 2
- EPAorganization · 1
- SENTRON 3NA COM Fuseproduct · 1
- Capital Embedded AR Classicproduct · 1
- Siemensorganization · 1
- NET Client Library for SIMATIC S7 Webserver APIproduct · 1
- FBIorganization · 1
- ZoomEyevendor · 1
- Siveillance Control Proproduct · 1
- SIMATIC WinCCproduct · 1
- Desigo CCproduct · 1
- TIA Portalproduct · 1
- WibuKeyproduct · 1
- US critical infrastructure sectorsvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.