Multiple vulnerabilities in Siemens products (July 15, 2026)
Multiple vulnerabilities have been discovered in Siemens products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
CSIRTS triage
- What
- Multiple vulnerabilities allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
- Who is affected
- Deployments of Siemens products are affected.
- Urgency
- Remediation is urgent due to the potential for remote code execution and denial of service.
- Action
- Apply patches as they become available.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0880/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-544290.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
- Moderate exploitation riskCVE-2021-416172.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all scored CVEs.
- Moderate exploitation riskCVE-2023-285312.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 81% of all scored CVEs.
- Low exploitation riskCVE-2023-513840.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all scored CVEs.
- Low exploitation riskCVE-2023-529270.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
- Low exploitation riskCVE-2024-267830.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.
- Low exploitation riskCVE-2024-270560.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.
- Low exploitation riskCVE-2024-289560.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
- Low exploitation riskCVE-2024-369030.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.
- Low exploitation riskCVE-2024-369270.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilitiesubuntu
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of servicecert-bund
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of servicecert-bund
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service and nonspecific attackcert-bund
- high[UPDATE] [high] Linux Kernel: Multiple vulnerabilitiescert-bund
- highUSN-8620-3: Linux kernel (Intel IoTG) vulnerabilitiesubuntu
- high[NEW] [high] IBM Security Verify Access: Multiple vulnerabilitiescert-bund
- unknownMultiples vulnérabilités dans le noyau Linux d'Ubuntu (31 juillet 2026)cert-fr-avis
- highUSN-8620-2: Linux kernel (Azure FIPS) vulnerabilitiesubuntu
- criticalSiemens SIMATIC S7-PLCSIM Advancedcisa
- unknownexploitedSiemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPcisa
- highUSN-8620-1: Linux kernel vulnerabilitiesubuntu
Recent advisories for Siemens products
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0229 [1.00] [M/H] Vulnerabilities fixed in Siemens productsncsc-nl · 2026-07-14
- unknownMultiple vulnerabilities in Siemens products (July 10, 2026)cert-fr-avis · 2026-07-10
- unknownSiemens Products using OpenSSLcisa · 2026-06-23
More from CERT-FR Avis de sécurité
- unknownMultiples vulnérabilités dans le noyau Linux d'Ubuntu (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans le noyau Linux de SUSE (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans le noyau Linux de Red Hat (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans Progress MOVEit Transfer (31 juillet 2026)2026-07-31
- unknownMultiples vulnérabilités dans le noyau Linux de Debian LTS (31 juillet 2026)2026-07-31