CVE-2026-59241
High
Description
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.
SeverityHigh
CVSS8.8
Exploit probability—
ProductSIMATIC WinCC V7.5
PublishedOct 13, 2026
First seenOct 13, 2026
Weakness typeCWE-266CWE-266
How to fix
Update
- Siemens SIMATIC WinCC V8.0V8.0 Update 11 or later
- Siemens SIMATIC WinCC V8.1V8.1 Update 7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens SIMATIC WinCC V7.5 | 0 | — |
| Siemens SIMATIC WinCC V8.0 | v < V8.0 Update 11 | V8.0 Update 11 |
| Siemens SIMATIC WinCC V8.1 | v < V8.1 Update 7 | V8.1 Update 7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.