Read the docs
TI-2026-71570 Aliases CVE-2026-59241GHSA-q747-5rxh-c5w7

Privilege escalation in Siemens SIMATIC WinCC via database role

Priority MEDIUM 40CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Siemens SIMATIC WinCC V7.5 (all versions), V8.0 before V8.0 Update 11 and V8.1 before V8.1 Update 7 are affected. The application does not sufficiently restrict the permissions assigned to a database role (CWE-266). An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed SIMATIC WinCC V8.0 (Siemens): V8.0 Update 11SIMATIC WinCC V8.1 (Siemens): V8.1 Update 7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC WinCC V7.5all versions—No fix listedCNA
SiemensSIMATIC WinCC V8.0before V8.0 Update 11V8.0 Update 11Patch availableCNA
SiemensSIMATIC WinCC V8.1before V8.1 Update 7V8.1 Update 7Patch availableCNA
  • SIMATIC WinCC V7.5 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC WinCC V8.0 VendorSiemens Affected before V8.0 Update 11 Fixed in V8.0 Update 11 Patch available CNA
  • SIMATIC WinCC V8.1 VendorSiemens Affected before V8.1 Update 7 Fixed in V8.1 Update 7 Patch available CNA

Remediation

Update SIMATIC WinCC V8.0 to V8.0 Update 11 and SIMATIC WinCC V8.1 to V8.1 Update 7. The sources list no fixed version for SIMATIC WinCC V7.5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA SIMATIC WinCC V8.0 (Siemens) Fixed in V8.0 Update 11
  • Fix · CNA SIMATIC WinCC V8.1 (Siemens) Fixed in V8.1 Update 7

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-59241
  2. 2026-10-13 Alias added: GHSA-q747-5rxh-c5w7
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed
  5. 2026-10-16 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences