cve.bz

CVE-2026-58114 siemens: Weak Authentication

7.7 highEPSS 0.3%

High (7.7) in siemens. EPSS 0.3% estimated probability of exploitation activity in the next 30 days.

On this page
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

Severity

CVSS 4.0

7.7 high
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.3% estimated probability of exploitation activity in the next 30 days; 28th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
CISA's assessment (SSVC)
Exploitation: none · Automatable: no · Technical impact: total, assessed 2026-11-10. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWE
CWE-1390 Weak Authentication
OWASP Top 10
A07:2025 Authentication Failures
Published
Modified
Assigned by
siemens (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-58114 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-58114?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-58114?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-58114 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-58114

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-58114](https://cve.bz/cve/badge/CVE-2026-58114.svg)](https://cve.bz/cve/CVE-2026-58114)

HTML:

<a href="https://cve.bz/cve/CVE-2026-58114"><img src="https://cve.bz/cve/badge/CVE-2026-58114.svg" alt="CVE-2026-58114"></a>

Affected

  • siemens:simatic batch v9.1
  • siemens:simatic information server 2020
  • siemens:simatic information server 2022
  • siemens:simatic pcs 7 v9.1
  • siemens:simatic process historian 2020
  • siemens:simatic process historian 2022
  • siemens:simatic wincc runtime professional v17
  • siemens:simatic wincc runtime professional v18
  • siemens:simatic wincc runtime professional v19
  • siemens:simatic wincc runtime professional v20
  • siemens:simatic wincc runtime professional v21
  • siemens:simatic wincc v7.5
  • siemens:simatic wincc v8.0
  • siemens:simatic wincc v8.1

Versions

From the CNA's record in the CVE List.

ProductAffected
Siemens SIMATIC BATCH V9.1all versions
Siemens SIMATIC Information Server 2020all versions
Siemens SIMATIC Information Server 2022all versions
Siemens SIMATIC PCS 7 V9.1all versions
Siemens SIMATIC Process Historian 2020all versions
Siemens SIMATIC Process Historian 2022all versions
Siemens SIMATIC WinCC Runtime Professional V17all versions
Siemens SIMATIC WinCC Runtime Professional V18all versions
Siemens SIMATIC WinCC Runtime Professional V19all versions
Siemens SIMATIC WinCC Runtime Professional V20all versions
Siemens SIMATIC WinCC Runtime Professional V21all versions
Siemens SIMATIC WinCC V7.5all versions
Siemens SIMATIC WinCC V8.0all versions
Siemens SIMATIC WinCC V8.1all versions

References

Check your stackJSON