Dashboard / CVE-2026-58114

CVE-2026-58114

HIGH
MEDIUM Priority: 0.03 BB Relevance: 65/100
Published: 2026-11-10 Modified: 2026-11-12 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: Present
VC: High
VI: High
VA: High

Description

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

Weakness Classification (1)

Affected Software (28)

VendorProductVersion
Siemens SIMATIC BATCH V9.1 0 < *
Siemens SIMATIC BATCH V9.1 0 < *
Siemens SIMATIC Information Server 2020 0 < *
Siemens SIMATIC Information Server 2020 0 < *
Siemens SIMATIC Information Server 2022 0 < *
Siemens SIMATIC Information Server 2022 0 < *
Siemens SIMATIC PCS 7 V9.1 0 < *
Siemens SIMATIC PCS 7 V9.1 0 < *
Siemens SIMATIC Process Historian 2020 0 < *
Siemens SIMATIC Process Historian 2020 0 < *
Siemens SIMATIC Process Historian 2022 0 < *
Siemens SIMATIC Process Historian 2022 0 < *
Siemens SIMATIC WinCC Runtime Professional V17 0 < *
Siemens SIMATIC WinCC Runtime Professional V17 0 < *
Siemens SIMATIC WinCC Runtime Professional V18 0 < *
Siemens SIMATIC WinCC Runtime Professional V18 0 < *
Siemens SIMATIC WinCC Runtime Professional V19 0 < *
Siemens SIMATIC WinCC Runtime Professional V19 0 < *
Siemens SIMATIC WinCC Runtime Professional V20 0 < *
Siemens SIMATIC WinCC Runtime Professional V20 0 < *
Siemens SIMATIC WinCC Runtime Professional V21 0 < *
Siemens SIMATIC WinCC Runtime Professional V21 0 < *
Siemens SIMATIC WinCC V7.5 0 < *
Siemens SIMATIC WinCC V7.5 0 < *
Siemens SIMATIC WinCC V8.0 0 < *
Siemens SIMATIC WinCC V8.0 0 < *
Siemens SIMATIC WinCC V8.1 0 < *
Siemens SIMATIC WinCC V8.1 0 < *

References & Advisories (1)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

7.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.34%
Raw Score 0.003450
Percentile 28.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00345
2026-11-12
0.00345

Intelligence Sources

mitre ref →
nvd ref →

External Links