CVE WatchNov 10, 2026

CVE-2026-58114

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Informatio

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-1390

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

Official references

cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-970803.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-960186.5 MED

—

——0Weak authentication in Windows AppContainer allows an authorized attacker to disclose information locally.5h CVE-2026-959445.5 MED

—

——0Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally.5h CVE-2026-945257.0 HIG

—

——0An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application. The security update addresses the vulnerability by correcting the way that WER handles and executes files.5h CVE-2026-701827.8 HIG

—

——0Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.6h CVE-2026-1221648.0 HIG

—

——0Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.12h CVE-2026-1207836.4 MED

—

——0Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.5h