Siemens Mendix SAML module allows assertion-replay login bypass
Unauthenticated attackers can replay a valid IdP-initiated SAML response; fixes are V4.2.4 and V3.6.29.
46
Vendor
Siemens
- Mentions · 7d3
- Mentions · 30d35
- All mentions58
- First seenAug 13, 2026
- Last mentioned1d ago
Timeline
58 articles · newest firstIndustrial vendors assess PHP2Shell; several OT products affected
Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.
82
Siemens Mendix SAML module has an authentication-bypass flaw
Mendix 9 builds before V3.6.29 and Mendix 10 and 11 builds before V4.2.4 are affected; Canada urges administrators to apply updates.
52
RUGGEDCOM CROSSBOW before 6.0 allows SQL injection and credential theft
Authenticated attackers can run SQL, steal admin credentials, or change configuration; Siemens says to update to V6.0 or later.
62
Siemens Industrial Edge devices leak internal APIs to logged-in users
Some devices have versioned fixes, while listed SIMATIC HMI panels currently have no fix.
58
RUGGEDCOM APE1808 inherits Nozomi Guardian and CMC flaws
All listed APE1808 versions are affected; the highest detailed score is 7.5 for unvalidated Smart Polling connections.
58
PSS SINCAL WibuKey flaw can crash systems (CVE-2026-84854)
Only legacy WibuKey dongle licensing is affected; V22.5 is fixed in Update 5, while V21.5 and V22.0 need a manual runtime install.
48
RUGGEDCOM CROSSBOW SAC before 6.0 includes vulnerable SQLite code
Five SQLite flaws can yield code execution, denial of service, or information disclosure; the product fix is V6.0 or later.
60
Siemens Industrial Edge App Publisher before 1.27.9 vulnerable to RCE (CVE-2026-78556, CVE-2026-78557)
Update to V1.27.9 or later to prevent network attackers from impersonating the management server and achieving RCE via Node.js.
60
Siemens SIMATIC IPCs allow UEFI Secure Boot bypass (CVE-2026-72895)
Physical access attackers can boot arbitrary OS signed with AMI test key; fixes released for BX-21A, RW-543A, and IPC227G series.
60
Siemens APOGEE, TALON and Desigo flaws can cause denial of service
Several Desigo controllers at version 2.3 and later have no planned fix for CVE-2026-89208.
62
SIMATIC WinCC flaw lets database users run host commands
WinCC V7.5 has no fix; V8.0 and V8.1 are fixed in Update 11 and Update 7.
64
SIMATIC S7-1500 web server flaws can hijack authorized browser sessions
All listed firmware versions are affected, Siemens is still preparing fixes, and eight CVEs are named.
64
Siemens Capital Embedded AR Classic has remote out-of-bounds read
R20-11 is fixed in V2303, while all 431-422 builds have no planned fix and should stay behind firewalls.
44
Siemens SIMATIC S7 Webserver API vulnerabilities
NET Client Library for SIMATIC S7 Webserver API versions before 3.3.61 and 3.3.62 vulnerable to path traversal and sensitive information exposure; update to 3.3.61 or later.
55
S7-1500 CPU 1518 MFP Linux subsystem flaws lack a fix
Firmware V3.1.7 and later on five 1518 and SIPLUS MFP CPUs is affected, including OpenSSH CVE-2021-41617.
54
Siemens SIMATIC S7-1500 TM MFP Linux subsystem has unfixed flaws
All GNU/Linux subsystem versions on the TM MFP V1.1.1 are affected, and Siemens says no fix is available yet.
52
Siemens Software Center before 4.0.9.8 allows local DLL hijack
Siemens says the flaw has known active exploitation and that existing installs auto-update to 4.0.9.8 on next startup.
74
Siemens Industrial Edge Device Kit access restriction issues
Industrial Edge Device Kit versions V1.10 to V1.26 allow authenticated remote access to sensitive information; update to V1.26.2-1, V1.27.1-1 or V1.28.0-6 recommended for affected ranges.
50
Siemens SENTRON 3NA COM Fuse before 5.2 can be forced into DoS
An unsolicited encrypted ZigBee rejoin response can change the node ID; recovery requires rebuilding the network.
42
Siemens Software Center DLL side-loading flaw exploited before 4.0.9.8
Attackers shipped signed Software Center 3.5.8.7 with malicious DLLs; every build before 4.0.9.8 is affected.
76
Siemens Software Center DLL flaw exploited in ClickFix attacks
CVE-2026-110936, fixed in 4.0.9.8, was used to side-load malware beside an unmodified signed executable in the Romulus campaign.
76
CISA says attackers chain Plex flaws in Plex2Shell server breaches
Federal agencies must patch or mitigate by October 23; honeypots were hit with a cryptominer.
80
CISA Orders Patch for Exploited Plex2Shell, Siemens and SiteGuard Flaws
CISA added four Plex2Shell vulnerabilities and two other exploited flaws to its KEV catalog, ordering federal agencies to patch them by October 23 and November 3, 2026.
75
Attackers exploit Siemens Software Center flaw in ClickFix campaign
CVE-2026-110936 let version 3.5.8.7 load attacker files beside a signed binary; 4.0.9.8 fixes it.
74
CISA adds six exploited vulnerabilities to the KEV catalog
The entries cover four Plex Media Server bugs, SiteGuard command injection, and a Siemens path flaw.
76
Siemens Software Center DLL side-loading flaw exploited in ClickFix campaign
CVE-2026-110936 (CVSS 8.4) is fixed in Software Center 4.0.9.8; Siemens lists startup, file and IP indicators.
76
ClickFix attacks exploit Siemens Software Center DLL flaw to deploy a RAT
CVE-2026-110936, CVSS v4 8.4, is fixed in Siemens Software Center 4.0.9.8; abused builds sideloaded archive.dll via a signed copy.
78
CISA lists Siemens Software Center DLL path flaw as exploited
Authenticated local attackers can plant a DLL for code execution; the federal action due date is November 3, 2026.
68
Siemens Software Center DLL sideloading flaw exploited in the wild
CVE-2026-110936 affects Siemens Software Center before V4.0.9.8, and Siemens reports active exploitation.
73
Germany and NVIDIA sign intent to advance industrial AI
NVIDIA named planned investments in Agile Robots, Avelios Medical, Mirelo and Reflex Aerospace.
48
Siemens Software Center DLL flaw exploited in Romulus ClickFix attacks
CVE-2026-110936 let attackers side-load DLLs beside a signed Software Center build; version 4.0.9.8 fixes it.
76
ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
Siemens issued 17 ICS advisories, and Rockwell patched a critical unauthenticated ArmorBlock takeover flaw.
68
Thousands of wind and solar park systems sit exposed on the internet across Europe
Modat and NCSC-NL found 8,547 internet-reachable wind and solar control systems across Europe.
77
OT Attacks on US Critical Infrastructure Could Disrupt Military Operations and Physical Processes
State-linked actors are targeting US critical-infrastructure OT, with confirmed water-system disruption and Volt Typhoon pre-positioning.
81
Siemens Mendix Runtime (Update A)
CISA revoked its Siemens Mendix Runtime advisory after CVE-2026-7891 was rejected as expected behavior.
34
How tax policy can stop threat actors from breaching US water systems
State-backed threat actors are actively breaching US water systems and industrial infrastructure, with a 2024 incident causing water tank overflow in Texas.
70
Siemens Industrial Edge Management
Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.
74
Siemens WTV676 and WTV776
Siemens WTV676 and WTV776 have an unauthenticated remote flaw that can disable web access.
40
Siemens SIPLUS and SIMATIC Products
CISA lists many Siemens SIPLUS and SIMATIC products in an advisory tied to a Linux kernel crypto issue.
32
Related CVEs
by mentions- CVE-2026-110936<1%8.4DLL Search-Path Hijacking in Siemens Software Center
- CVE-2026-966562%8.6Admin-Triggered Arbitrary File Write & RCE in Plex Media Server
- CVE-2026-1069313%8.5OS command injection in SiteGuard Server Edition
- CVE-2026-966542%6.9Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- CVE-2026-966552%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-966522%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo…
- Unauthenticated DoS in Siemens APOGEE and TALON controllers
- CVE-2026-34223<1%8.6Client Code Execution via malicious graphics documents in Siemens Desigo CC
- CVE-2025-696576%7.2Memory Corruption in SQLite < 3.50.2 Affecting Apple and Siemens Products
Appears with
- CISAorganization · 32
- Siemens ProductCERTorganization · 14
- Siemens Software Centerproduct · 10
- FBIorganization · 8
- Rockwell Automationvendor · 7
- NSAorganization · 7
- Schneider Electricvendor · 7
- Siemensorganization · 6
- Forescoutorganization · 6
- Canadian Centre for Cyber Securityorganization · 5
- EPAorganization · 4
- Romulusmalware · 4
- Simatic S7-1500product · 3
- Desigo CCproduct · 3
- Plexvendor · 3
- Plex Media Serverproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.