{"id":"CVE-2026-58114","kind":"vulnerability","aliases":["CVE-2026-58114"],"related":[],"title":"Siemens SIMATIC WinCC and PCS 7: NTLM relay lets attackers impersonate users","description":"A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.","summary":"Several Siemens SIMATIC industrial control products, including WinCC, PCS 7, Process Historian and Information Server, use the deprecated NTLM protocol for remote user authentication. An attacker in a man-in-the-middle position can relay NTLM logins and impersonate a legitimate user, with impact depending on the services reachable, such as a SQL server used by WinCC.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SIMATIC WinCC","fixed":[],"affected":"V7.5, V8.0, V8.1 (all versions per NVD)","ecosystem":"vendor"},{"name":"SIMATIC WinCC Runtime Professional","fixed":[],"affected":"V17, V18, V19, V20, V21 (all versions per NVD)","ecosystem":"vendor"},{"name":"SIMATIC PCS 7","fixed":[],"affected":"V9.1 (all versions per NVD)","ecosystem":"vendor"},{"name":"SIMATIC BATCH","fixed":[],"affected":"V9.1 (all versions per NVD)","ecosystem":"vendor"},{"name":"SIMATIC Process Historian","fixed":[],"affected":"2020, 2022 (all versions per NVD)","ecosystem":"vendor"},{"name":"SIMATIC Information Server","fixed":[],"affected":"2020, 2022 (all versions per NVD)","ecosystem":"vendor"}],"ecosystems":[],"tags":["industrial-control","ntlm","pcs-7","siemens","simatic","vendor","wincc","windows"],"not_affected_if":["no-simatic-products"],"how_to_check":"- Check whether any SIMATIC product listed in the advisory (WinCC, WinCC Runtime Professional, PCS 7, Process Historian, Information Server, SIMATIC BATCH) is installed on your systems, and which version.","fix":null,"status":"open","published_at":"2026-11-10T12:17:20+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:36+00:00","updated_at":"2026-11-10T12:23:52+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T12:22:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Siemens SIMATIC WinCC and PCS 7: NTLM relay lets attackers impersonate users","impact":"high","summary":"Several Siemens SIMATIC industrial control products, including WinCC, PCS 7, Process Historian and Information Server, use the deprecated NTLM protocol for remote user authentication. An attacker in a man-in-the-middle position can relay NTLM logins and impersonate a legitimate user, with impact depending on the services reachable, such as a SQL server used by WinCC.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["siemens","simatic","wincc","pcs-7","industrial-control","ntlm","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker impersonates a legitimate user and reaches connected services","analyst_note":"Check the Siemens ProductCERT advisory for fixed versions or workarounds for each SIMATIC product; the NVD entry does not state a fix.","how_to_check":"- Check whether any SIMATIC product listed in the advisory (WinCC, WinCC Runtime Professional, PCS 7, Process Historian, Information Server, SIMATIC BATCH) is installed on your systems, and which version.\n- unknown for further checks: the sources do not say how to confirm NTLM use in these products.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-simatic-products"],"who_is_affected":"Sites running the listed SIMATIC WinCC, PCS 7, Process Historian, Information Server or BATCH versions, where remote user authentication relies on NTLM. The sources list all versions of the affected products as vulnerable and do not describe a configuration that avoids the issue. Systems that do not run these products are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000826,"input_tokens":4895,"output_tokens":672,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Siemens ProductCERT advisory for fixed versions or workarounds for each SIMATIC product; the NVD entry does not state a fix.","search":"'-2026':14A,17A '-58114':15A,18A '-7':41B '2020':119C,137C '2022':125C,143C '7':6A,27A,56B,130C 'access':244C 'achiev':219C 'affect':196C 'allow':213C 'attack':10A,72B,216C 'authent':70B,205C,229C 'batch':29A,112C 'control':38B,51B 'could':212C 'cve':13A,16A 'depend':92B,238C 'deprec':64B,208C 'e.g':245C 'historian':32A,58B,136C,142C 'identifi':109C 'impact':91B,237C 'imperson':11A,86B,231C 'includ':53B 'industri':37B,50B 'industrial-control':36B 'inform':60B,117C,123C 'information':34A 'legitim':88B,233C 'let':9A 'login':84B 'machin':221C 'man':76B 'man-in-the-middl':75B 'middl':79B,224C 'ntlm':7A,39B,65B,83B,209C,228C 'pcs':5A,26A,40B,55B,129C 'posit':80B,225C 'potenti':236C 'process':31A,57B,135C,141C 'product':52B 'profession':149C,156C,163C,170C,177C 'professional':24A 'proper':200C 'protocol':66B,210C 'reachabl':96B 'relay':8A,82B,227C 'remot':68B,203C,215C 'runtim':148C,155C,162C,169C,176C 'runtime':23A 'secur':201C 'server':35A,61B,101B,118C,124C,248C 'servic':95B,241C 'sever':47B 'siemen':1A,42B,48B 'simat':2A,43B,49B,111C,116C,122C,128C,134C,140C,146C,153C,160C,167C,174C,181C,186C,191C 'simatic':19A,21A,25A,28A,30A,33A 'sql':100B,247C 'system':197C 'unauthent':214C 'use':62B,102B,249C 'user':12A,69B,89B,204C,234C 'v17':150C 'v18':157C 'v19':164C 'v20':171C 'v21':178C 'v7.5':183C 'v8.0':188C 'v8.1':193C 'v9.1':113C,131C 'vendor':44B 'version':115C,121C,127C,133C,139C,145C,152C,159C,166C,173C,180C,185C,190C,195C 'vulner':106C 'wincc':3A,20A,22A,45B,54B,104B,147C,154C,161C,168C,175C,182C,187C,192C,251C 'window':46B","nicknames":[],"mitigations":[],"who_affected":"Sites running the listed SIMATIC WinCC, WinCC Runtime Professional, PCS 7, BATCH, Process Historian or Information Server versions (all versions listed by NVD). An attacker needs a machine-in-the-middle position on the network to relay NTLM logins; impact depends on reachable services, e.g. the SQL server used by WinCC. Fix status is not yet confirmed from Siemens' own advisory. Sites without these products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["batch","informationserver","pcs7","processhistorian","simaticbatch","simaticinformationserver","simaticpcs7","simaticprocesshistorian","simaticwincc","simaticwinccruntimeprofessional","wincc","winccruntimeprofessional"],"ptokens":["batch","historian","information","pcs","process","professional","runtime","server","simatic","wincc"],"labels":["high","industrialcontrol","ntlm","pcs7","siemens","simatic","vendor","wincc","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-58114':15A,18A '7':6A,27A 'attack':10A 'batch':29A 'cve':13A,16A 'historian':32A 'imperson':11A 'information':34A 'let':9A 'ntlm':7A 'pcs':5A,26A 'process':31A 'professional':24A 'relay':8A 'runtime':23A 'server':35A 'siemen':1A 'simat':2A 'simatic':19A,21A,25A,28A,30A,33A 'user':12A 'wincc':3A,20A,22A","search_b":"'-7':41B '7':56B 'attack':72B 'authent':70B 'control':38B,51B 'depend':92B 'deprec':64B 'historian':58B 'impact':91B 'imperson':86B 'includ':53B 'industri':37B,50B 'industrial-control':36B 'inform':60B 'legitim':88B 'login':84B 'man':76B 'man-in-the-middl':75B 'middl':79B 'ntlm':39B,65B,83B 'pcs':40B,55B 'posit':80B 'process':57B 'product':52B 'protocol':66B 'reachabl':96B 'relay':82B 'remot':68B 'server':61B,101B 'servic':95B 'sever':47B 'siemen':42B,48B 'simat':43B,49B 'sql':100B 'use':62B,102B 'user':69B,89B 'vendor':44B 'wincc':45B,54B,104B 'window':46B","search_c":"'2020':119C,137C '2022':125C,143C '7':130C 'access':244C 'achiev':219C 'affect':196C 'allow':213C 'attack':216C 'authent':205C,229C 'batch':112C 'could':212C 'depend':238C 'deprec':208C 'e.g':245C 'historian':136C,142C 'identifi':109C 'impact':237C 'imperson':231C 'inform':117C,123C 'legitim':233C 'machin':221C 'middl':224C 'ntlm':209C,228C 'pcs':129C 'posit':225C 'potenti':236C 'process':135C,141C 'profession':149C,156C,163C,170C,177C 'proper':200C 'protocol':210C 'relay':227C 'remot':203C,215C 'runtim':148C,155C,162C,169C,176C 'secur':201C 'server':118C,124C,248C 'servic':241C 'simat':111C,116C,122C,128C,134C,140C,146C,153C,160C,167C,174C,181C,186C,191C 'sql':247C 'system':197C 'unauthent':214C 'use':249C 'user':204C,234C 'v17':150C 'v18':157C 'v19':164C 'v20':171C 'v21':178C 'v7.5':183C 'v8.0':188C 'v8.1':193C 'v9.1':113C,131C 'version':115C,121C,127C,133C,139C,145C,152C,159C,166C,173C,180C,185C,190C,195C 'vulner':106C 'wincc':147C,154C,161C,168C,175C,182C,187C,192C,251C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productcert@siemens.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58114","severity":null,"published_at":"2026-11-10T12:17:20+00:00","modified_at":"2026-11-10T12:17:20+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58114:2447","url":null,"severity":null,"published_at":"2026-11-10T12:23:52+00:00","modified_at":"2026-11-10T12:23:52+00:00","first_seen_at":"2026-11-10T12:23:52+00:00","fetched_at":"2026-11-10T12:23:52+00:00","note":"Siemens ProductCERT advisory for this CVE not found via search/ProductCERT page (published today, likely not indexed yet); only the NVD description (Siemens CNA) read. Fix unknown; settle by reading the SSA on productcert.siemens.com once published. Nothing verified. No exploitation or PoC seen."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}