CVE-2026-59241

HighCVSS 8.8

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

41th percentile - higher than 41% of all known CVEs

Summary

A vulnerability in SIMATIC WinCC V7.5, V8.0, and V8.1 is due to insufficient restriction of permissions assigned to a database role. An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to system compromise.

Risk Assessment

The risk includes the possibility of full compromise of the WinCC system, potentially leading to integrity and availability issues in industrial processes.

Recommendation

Update to the latest versions (V8.0 Update 11 or V8.1 Update 7) and restrict database role permissions.

Other vulnerabilities in SIMATIC WinCC

CVE-2023-28829Low
A vulnerability affects SIMATIC NET PC Software, SIMATIC PCS 7, SIMATIC WinCC (< V8.0), and SINAUT Software ST7sc, which used legacy OPC DA, HDA, and AE services by default. These services, built on Windows ActiveX and DCOM, do not implement state-of-the-art authentication and encryption.

Original NVD description (English source)

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS