// AI threat desk · 24 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumCVECVSS not assigned

Siemens APOGEE, TALON and Desigo flaws could cause denial of service

CISA said multiple flaws in Siemens APOGEE, TALON and Desigo products could affect device availability. The advisory was published Oct 22, 2026.

· 2 min read
AI-generated image of engineers monitoring building-control systems and industrial equipment in a security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The vulnerabilities could cause a denial of service and affect the availability of affected Siemens devices.
  • APOGEE and TALON products are associated with four listed CVEs, while Desigo PXC and PXM products are associated with CVE-2026-89208.
  • CISA recommends updating to the latest versions released by Siemens for several affected products.

CISA published an advisory on Oct 22, 2026, reporting multiple vulnerabilities in Siemens APOGEE, TALON and Desigo PXC/PXM products. The flaws could allow an attacker to cause a denial of service and potentially affect the availability of the affected devices.

The affected products are deployed worldwide. CISA identified out-of-bounds read, integer underflow and stack-based buffer overflow vulnerabilities.

SecurityInfoWatch described Siemens Desigo Mass Notification as an integrated communication system that can operate in one building or across a large campus, with operators using a centralized dashboard to manage, track and review emergency incidents.

On this page

CISA listed five CVEs and three vulnerability types

CISA listed CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076 for APOGEE MBC (PPC) BACnet products, with the listed version applying to all versions. It listed CVE-2026-89208 for Desigo PXC00-E.D version 2.3 or later.

CISA gave network segmentation and FTP/Web mitigations

For CVE-2026-89208, CISA recommended applying network segmentation and placing the controllers behind properly configured gateways or firewalls.

CISA also recommended disabling the FTP/Web service. The advisory noted that the service is disabled by default on APOGEE, Desigo and TALON products.

Siemens fix options listed by CISA

CISA listed vendor fixes requiring an update to V3.5.7 or later for some affected products and to V2.8.21 or later for others.

The advisory also said that no fix is currently planned for some affected products.

CISA said Siemens has released new versions for several affected products and recommends updating to the latest versions. It also listed product-specific fixes, including updates to V3.5.7 or later and V2.8.21 or later.

For some affected products, CISA said no fix is planned. Its mitigation guidance includes disabling the FTP/Web service, which CISA said is disabled by default on APOGEE, Desigo and TALON products.

Vendor fixSource
Update to V3.5.7 or later versionCISA
Update to V2.8.21 or later versionCISA

What to do now

  1. Update to the latest versions.

FAQ

What happened to Siemens APOGEE, TALON and Desigo products?

CISA reported multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially affect the availability of affected devices.

Which Siemens products and CVEs are affected?

CISA listed four CVEs for APOGEE and TALON products and CVE-2026-89208 for Desigo PXC and PXM products.

What types of vulnerabilities did CISA identify?

The advisory identified out-of-bounds read, integer underflow and stack-based buffer overflow vulnerabilities.

How do I fix the Siemens vulnerabilities?

CISA said Siemens released new versions for several affected products and recommends updating to the latest versions. It listed updates to V3.5.7 or later and V2.8.21 or later for some products.

What network protections did CISA recommend for CVE-2026-89208?

CISA recommended network segmentation and placing the controllers behind properly configured gateways or firewalls.

Sources

  1. Siemens APOGEE, TALON and Desigo PXC/PXM Products, CISAPrimary
  2. Siemens' Desigo Mass Notification System, Security
How we checked this story
ClaimSourceStatus
CISA reported multiple vulnerabilities that could cause denial of service and potentially affect the availability of affected Siemens devices.CISAConfirmed
CISA said the affected products are deployed worldwide and Siemens is headquartered in Germany.CISAConfirmed
CISA identified out-of-bounds read, integer underflow and stack-based buffer overflow vulnerabilities.CISAConfirmed
CISA listed CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 and CVE-2026-102076 for affected APOGEE and TALON products.CISAConfirmed
CISA listed CVE-2026-89208 for affected Desigo PXC and PXM products.CISAConfirmed
CISA recommended network segmentation and properly configured gateways or firewalls for CVE-2026-89208.CISAConfirmed
CISA recommended disabling the FTP/Web service, which it said is disabled by default on APOGEE, Desigo and TALON products.CISAConfirmed
CISA said no fix is planned for some affected products.CISAConfirmed
CISA listed updates to V3.5.7 or later as vendor fixes for some affected products.CISAConfirmed
CISA listed updates to V2.8.21 or later as vendor fixes for some affected products.CISAConfirmed
CISA associated one vulnerability with CWE-125 out-of-bounds read.CISAConfirmed
CISA associated one vulnerability with CWE-191 integer underflow.CISAConfirmed
CISA associated one vulnerability with CWE-121 stack-based buffer overflow.CISAConfirmed
SecurityInfoWatch described Desigo Mass Notification as a Siemens integrated communication system usable in one building or across a large campus.SecurityInfoWatch, via SecurityAttributed
SecurityInfoWatch said operators use a centralized dashboard to manage, track and review emergency incidents.SecurityInfoWatch, via SecurityAttributed
CISA published its report on Oct 22, 2026.CISAConfirmed

Could not verify

  • Whether the vulnerabilities have been exploited in the wild is not established
  • How many devices or organizations are affected is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok