CVE-2026-3014

criticalCVSS 9.1covered by 3 sourcesfirst seen 2026-07-14

View CSAF Summary Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code Execution attack. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Siveillance Video are affected: Siveillance Video V2023 R3 vers:intdot/<23.3.27 (CVE-2026-3014) Siveillance Video V2024 R1 vers:intdot/<24.1.16 (CVE-2026-3014) Siveillance Video V2025 vers:intdot/<25.1.15 (CVE-2026-3014) CVSS Vendor Equipment Vulnerabilities v3 9.1 Siemens Siemens Siveillance Video Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrastructure Sectors: Critical Manufacturing, Communications, Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-3014 Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service. View CVE Details Affected Products Siemens Siveillance Video Vendor: Siemens Product Version: Siveillance Video V2023 R3 < V23.3.27, Siveillance Video V2024 R1 < V24.1.16, Siveillance Video V2025 < V25.1.15 Product Status: known_affected Remediations Vendor fix Update to V23.3 HotfixRev27 or later version https://support.industry.siemens.com/cs/ww/en/view/109827783/ Vendor fix Update to V24.1 HotfixRev16 or later version https://support.industry.siemens.com/cs/ww/en/view/109976123/ Vendor fix Update to V25.1 HotfixRev15 or later version https://support.industry.siemens.com/cs/ww/en/view/109988670/ Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV

CSIRTS triage

What: OS command injection vulnerability in Siveillance Video Management Server allowing remote code execution.
Who is affected: Siveillance Video deployments version 2023 R3, 2024 R1, and 2025 prior to specified patch versions.
Urgency: Critical; unauthenticated remote code execution with CVSS 9.1.
Action: Upgrade to Siveillance Video V2023 R3 >=23.3.27, V2024 R1 >=24.1.16, or V2025 >=25.1.15.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-3014

Get an email if CVE-2026-3014 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.

Advisory coverage (3)

criticalSiemens Siveillance Videocisa · 2026-08-13
unknownNCSC-2026-0282 [1.00] [M/H] Vulnerabilities fixed in Siemens productsncsc-nl · 2026-08-11
criticalCVE-2026-3014: Milestone has released a new version of XProtect® (and several cumulative patch updates) which …nvd · 2026-07-14

External references

NVD record for CVE-2026-3014

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-3014 status](https://www.csirts.com/badge/CVE-2026-3014)](https://www.csirts.com/cve/CVE-2026-3014)