CISA republishes Siemens CVE-2026-89208 advisories; some products unfixed
First merged summary.
CISA republished Siemens advisories on CVE-2026-89208; several Desigo and AR Classic builds have no planned fix.
On October 22, 2026, CISA republished Siemens advisories covering CVE-2026-89208, an unauthenticated remote out-of-bounds read of packet data. On APOGEE, TALON and Desigo PXC/PXM controllers, the flaws can cause denial of service and affect availability. Siemens says no fix is planned for listed Desigo PXC and PXM products at version 2.3 and later and advises network segmentation; newer builds exist for several other affected products. On Capital Embedded AR Classic, the same weakness (CWE-125) can cause abnormal behavior, instability or denial of service. R20-11 is fixed in V2303 or later; all 431-422 versions have no planned fix and should stay behind gateways or firewalls. Exploitation is not mentioned.
- CVE-2026-89208 is an unauthenticated remote out-of-bounds packet read.
- Listed Desigo PXC and PXM products at version 2.3 and later have no planned fix.
- APOGEE PXC Compact and Modular BACnet builds before 3.5.7 are affected.
- APOGEE PXC Compact and Modular P2 Ethernet builds before 2.8.21 are affected.
- Capital Embedded AR Classic R20-11 before V2303 is fixed in V2303 or later.
- AR Classic 431-422, all versions, is affected with no planned fix.
Timeline
dated events in the reporting · oldest first- Oct 22, 2026CISA republishes Siemens advisories covering CVE-2026-89208. · CISA Advisories
What each outlet adds
beyond the shared facts- CISA AdvisoriesBuilding-controller versions, Desigo no-fix status, and a listed CVSS 8.2.
- CISA AdvisoriesAR Classic scores 5.3, CWE-125, V2303 fix, and firewall guidance.
- Vendors
- Siemens
- Organizations
- CISASiemens ProductCERT
Coverage
oldest first · one row per article · UTC- · 8d ago
CISA AdvisoriesFirst report
Siemens APOGEE, TALON and Desigo flaws can cause denial of service
Several Desigo controllers at version 2.3 and later have no planned fix for CVE-2026-89208.
- · 8d ago
SIMATIC WinCC flaw lets database users run host commands
WinCC V7.5 has no fix; V8.0 and V8.1 are fixed in Update 11 and Update 7.
- · 8d ago
Siemens Capital Embedded AR Classic has remote out-of-bounds read
R20-11 is fixed in V2303, while all 431-422 builds have no planned fix and should stay behind firewalls.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-102073+3 related CVEs | Memory disclosure and DoS in Siemens APOGEE and TALON controllers | 8.8 group max | — | ||
| CVE-2026-59241 | Database-role privilege escalation in Siemens SIMATIC WinCC | 8.7 | — | ||
| CVE-2026-89208 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions = V2.3), Desigo… | 6.9 | — |