---
id: "CVE-2026-58114"
page: "https://infrastack.ai/live/CVE-2026-58114"
kind: "vulnerability"
aliases: ["CVE-2026-58114"]
title: "Siemens SIMATIC WinCC and PCS 7: NTLM relay lets attackers impersonate users"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SIMATIC WinCC", "fixed": [], "affected": "V7.5, V8.0, V8.1 (all versions per NVD)", "ecosystem": "vendor"}, {"name": "SIMATIC WinCC Runtime Professional", "fixed": [], "affected": "V17, V18, V19, V20, V21 (all versions per NVD)", "ecosystem": "vendor"}, {"name": "SIMATIC PCS 7", "fixed": [], "affected": "V9.1 (all versions per NVD)", "ecosystem": "vendor"}, {"name": "SIMATIC BATCH", "fixed": [], "affected": "V9.1 (all versions per NVD)", "ecosystem": "vendor"}, {"name": "SIMATIC Process Historian", "fixed": [], "affected": "2020, 2022 (all versions per NVD)", "ecosystem": "vendor"}, {"name": "SIMATIC Information Server", "fixed": [], "affected": "2020, 2022 (all versions per NVD)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["industrial-control", "ntlm", "pcs-7", "siemens", "simatic", "vendor", "wincc", "windows"]
not_affected_if: ["no-simatic-products"]
published_at: "2026-11-10T12:17:20+00:00"
first_seen_at: "2026-11-10T12:21:54+00:00"
updated_at: "2026-11-10T12:23:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58114", "first_seen_at": "2026-11-10T12:21:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T12:23:52+00:00"}]
exploit_sources: []
---

# Siemens SIMATIC WinCC and PCS 7: NTLM relay lets attackers impersonate users

Link for people: https://infrastack.ai/live/CVE-2026-58114 (this .md is for agents)

Several Siemens SIMATIC industrial control products, including WinCC, PCS 7, Process Historian and Information Server, use the deprecated NTLM protocol for remote user authentication. An attacker in a man-in-the-middle position can relay NTLM logins and impersonate a legitimate user, with impact depending on the services reachable, such as a SQL server used by WinCC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SIMATIC WinCC affected V7.5, V8.0, V8.1 (all versions per NVD) fixed no fixed version listed
- vendor:SIMATIC WinCC Runtime Professional affected V17, V18, V19, V20, V21 (all versions per NVD) fixed no fixed version listed
- vendor:SIMATIC PCS 7 affected V9.1 (all versions per NVD) fixed no fixed version listed
- vendor:SIMATIC BATCH affected V9.1 (all versions per NVD) fixed no fixed version listed
- vendor:SIMATIC Process Historian affected 2020, 2022 (all versions per NVD) fixed no fixed version listed
- vendor:SIMATIC Information Server affected 2020, 2022 (all versions per NVD) fixed no fixed version listed

## How to check

- Check whether any SIMATIC product listed in the advisory (WinCC, WinCC Runtime Professional, PCS 7, Process Historian, Information Server, SIMATIC BATCH) is installed on your systems, and which version.

## Timeline

- 2026-11-10T12:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58114
- 2026-11-10T12:23:52+00:00 analyst — Siemens ProductCERT advisory for this CVE not found via search/ProductCERT page (published today, likely not indexed yet); only the NVD description (Siemens CNA) read. Fix unknown; settle by reading the SSA on productcert.siemens.com once published. Nothing verified. No exploitation or PoC seen.

## From the sources

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_