CVE-2026-44415

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

CVSS 4.0

8.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-25)

CWE

CWE-35

Published

2026-10-13

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

References

• https://cert-portal.siemens.com/productcert/html/ssa-377139.html
• https://cert-portal.siemens.com/productcert/html/ssa-832641.html

Check your stackJSON