SIMATIC WINCC · CVE-2026-58114 · Vendor
NO FIX YET
Several Siemens SIMATIC industrial control products, including WinCC, PCS 7, Process Historian and Information Server, use the deprecated NTLM protocol for remote user authentication. An attacker in a man-in-the-middle position can relay NTLM logins and impersonate a legitimate user, with impact depending on the services reachable, such as a SQL server used by WinCC.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the listed SIMATIC WinCC, WinCC Runtime Professional, PCS 7, BATCH, Process Historian or Information Server versions (all versions listed by NVD). An attacker needs a machine-in-the-middle position on the network to relay NTLM logins; impact depends on reachable services, e.g. the SQL server used by WinCC. Fix status is not yet confirmed from Siemens' own advisory. Sites without these products can skip it.
Not affected if no-simatic-products
Who cares industrial-control, ntlm, pcs-7, siemens, simatic, wincc, windows
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Unknown from the sources.