CVE-2026-59241

State: Published
Severity: 8.7 High
Published: Oct 13, 2026
Updated: Oct 16, 2026
Reserved: Jul 3, 2026

Description

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	siemens
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	siemens

Weaknesses

CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
SIMATIC WinCC V7.5Siemens	all versionsAffected
SIMATIC WinCC V8.0Siemens	before V8.0 Update 11Affected
SIMATIC WinCC V8.1Siemens	before V8.1 Update 7Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-550198.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.