- The Siemens Industrial Edge flaws could let an authenticated remote attacker access sensitive internal information.
- Industrial Edge Cloud, Own and Virtual Devices earlier than version 1.28.1 are affected by CVE-2026-44414.
- Siemens released new versions for several affected products and recommended updating to the latest versions.
CISA published an advisory on Oct 22, 2026, covering multiple path traversal vulnerabilities in Siemens Industrial Edge Devices. The flaws could let an authenticated remote attacker access sensitive internal information.
The affected Industrial Edge Cloud, Own and Virtual Devices are versions earlier than 1.28.1. The advisory also lists SIMATIC IoT2050 Advanced IED and SM IED, and the SIMATIC HMI MTP1000 Unified Comfort Panel, among affected devices.
Siemens said Industrial Edge lets manufacturers deploy and manage applications in factory environments.
On this page
CVE-2026-44414 affects Industrial Edge versions before 1.28.1
CISA identified CVE-2026-44414 in Industrial Edge Cloud Device, Industrial Edge Own Device and Industrial Edge Virtual Device versions earlier than 1.28.1.
CISA listed the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N for one vulnerability and CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H for another.
| Product | Affected version | CVE |
|---|---|---|
| Industrial Edge Cloud Device | Earlier than 1.28.1 | CVE-2026-44414 |
| Industrial Edge Own Device | Earlier than 1.28.1 | CVE-2026-44414 |
| Industrial Edge Virtual Device | Earlier than 1.28.1 | CVE-2026-44414 |
| SIMATIC HMI MTP1000 Unified Comfort Panel | All versions | CVE-2026-44415 |
The advisory lists additional Siemens product vulnerabilities
CISA said the .NET Client Library for SIMATIC S7 Webserver API contains vulnerabilities that could expose sensitive information or write arbitrary files outside the intended download directory. Versions earlier than 3.3.61 and 3.3.62 are affected by CVE-2026-85114 and CVE-2026-85115.
CISA also said RUGGEDCOM CROSSBOW vulnerabilities could enable arbitrary SQL commands, retrieval of sensitive administrative credentials, privilege escalation, unauthorized system configuration changes or denial of service. Versions earlier than 6.0 are affected by CVE-2026-89196 through CVE-2026-89206, while RUGGEDCOM APE1808 devices are affected by five listed CVEs.
Siemens recommends updates or restricted network access
For affected products with a vendor fix, Siemens listed updating to version 1.28.1 or later. CISA said Siemens recommends updating to the latest versions for several affected products.
Siemens ProductCERT reported the vulnerabilities to CISA. Siemens is preparing further fixes for products that do not yet have them, while CISA said the company has released new versions for several affected products.
What to do now
- Update affected products to the latest versions.
- Ensure network access to affected products is limited to trusted parties only.
FAQ
What happened to Siemens Industrial Edge?
CISA published an advisory on Oct 22, 2026, covering multiple Siemens Industrial Edge path traversal vulnerabilities that could let an authenticated remote attacker access sensitive internal information.
Which Siemens Industrial Edge versions are affected?
Industrial Edge Cloud, Own and Virtual Devices earlier than version 1.28.1 are affected by CVE-2026-44414. CISA also listed SIMATIC IoT2050 Advanced IED and SM IED, and the SIMATIC HMI MTP1000 Unified Comfort Panel.
What are the Siemens Industrial Edge CVE numbers?
The Industrial Edge advisory covers CVE-2026-44414 and CVE-2026-44415.
How can Siemens Industrial Edge customers fix the vulnerabilities?
Siemens recommends updating affected products to the latest versions and ensuring network access to affected products is limited to trusted parties only.
Who reported the Siemens Industrial Edge vulnerabilities to CISA?
Siemens ProductCERT reported the vulnerabilities to CISA.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| CISA said Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could let an authenticated remote attacker access sensitive internal information. | CISA | Confirmed |
| The affected Industrial Edge Cloud, Own, and Virtual Devices are versions earlier than 1.28.1 and use CVE-2026-44414. | CISA | Confirmed |
| CISA listed a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N for one vulnerability. | CISA | Confirmed |
| CISA listed a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H for another vulnerability. | CISA | Confirmed |
| For affected products with a vendor fix, Siemens listed updating to version 1.28.1 or later. | CISA | Confirmed |
| Siemens ProductCERT reported the vulnerabilities to CISA. | CISA | Confirmed |
| Siemens Industrial Edge lets manufacturers deploy and manage applications in factory environments. | Siemens | Attributed |
| The .NET Client Library for SIMATIC S7 Webserver API contains vulnerabilities that could expose sensitive information or write arbitrary files outside the intended download directory. | CISA | Confirmed |
| Versions earlier than 3.3.61 and 3.3.62 of the .NET Client Library are affected by CVE-2026-85114 and CVE-2026-85115. | CISA | Confirmed |
| CISA reported that RUGGEDCOM CROSSBOW vulnerabilities could enable SQL commands, credential retrieval, privilege escalation, unauthorized configuration changes, or denial of service. | CISA | Confirmed |
| RUGGEDCOM CROSSBOW versions earlier than 6.0 are affected by CVE-2026-89196 through CVE-2026-89206. | CISA | Confirmed |
| RUGGEDCOM APE1808 devices are affected by five vulnerabilities identified as CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, and CVE-2026-33920. | CISA | Confirmed |
| CISA published its report on Oct 22, 2026. | CISA | Confirmed |
Could not verify
- Whether the vulnerabilities have been exploited in the wild is not established
- How many devices or organizations are affected is not established
- Whether Siemens has released fixes for every affected product is not established
- Whether the vulnerabilities are related to any other Siemens advisory is not established
Related stories
Vulns & PatchesPHP emergency patches fix PHP2Shell flaws that could run code
Vulns & PatchesPHP php2shell flaws could enable unauthenticated remote code execution
Vulns & PatchesOpenAI launches Patch the Planet to address critical open-source flaws