CVE WatchOct 23, 2026

CVE-2025-40818

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS

CVSS

3.3

Low

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Dec 9, 2025 · Last modified: Oct 23, 2026 · CWE-732

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-10-032026-10-31

Technical description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.

Official references

cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-626856.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1114995.5 MED

3.2%

——1Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.2d CVE-2026-118574—

2.8%

——1Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.2d CVE-2026-1070609.1 CRI

20.1%

——6Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.2d CVE-2026-1070557.5 HIG

17.3%

——5Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.2d CVE-2026-1070477.5 HIG

37.8%

——11Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.2d CVE-2026-1070447.5 HIG

24.0%

——7Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.2d