{"id":"CVE-2026-59082","kind":"vulnerability","aliases":["CVE-2026-59082"],"related":[],"title":"Siemens SIMATIC WinCC: opening files runs attacker code on the machine","description":"A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user execute arbitrary code on the device.","summary":"Affected SIMATIC WinCC versions run active content implicitly when a user opens a file. An attacker who gets a user to open a crafted file can make that user's device execute arbitrary code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SIMATIC WinCC V7.5","fixed":[],"affected":"all versions","ecosystem":"vendor"},{"name":"SIMATIC WinCC V8.0","fixed":[],"affected":"all versions","ecosystem":"vendor"},{"name":"SIMATIC WinCC V8.1","fixed":[],"affected":"all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["industrial-control","infrastructure","siemens","simatic-wincc","windows"],"not_affected_if":[],"how_to_check":"- Identify SIMATIC WinCC V7.5, V8.0 or V8.1 installations in the environment.\n- Check the installed WinCC version against Siemens' advisory; the sources do not list fixed versions.","fix":null,"status":"open","published_at":"2026-11-10T12:17:20+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:31+00:00","updated_at":"2026-11-10T12:23:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T12:22:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Siemens SIMATIC WinCC: opening files runs attacker code on the machine","impact":"high","summary":"Affected SIMATIC WinCC versions run active content implicitly when a user opens a file. An attacker who gets a user to open a crafted file can make that user's device execute arbitrary code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["siemens","simatic-wincc","industrial-control","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary code runs on the device after a user opens a file","analyst_note":"Check Siemens ProductCERT advisory for WinCC fixed versions and mitigations; NVD text gives none.","how_to_check":"- Identify SIMATIC WinCC V7.5, V8.0 or V8.1 installations in the environment.\n- Check the installed WinCC version against Siemens' advisory; the sources do not list fixed versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Industrial and plant operators running SIMATIC WinCC V7.5, V8.0 or V8.1 on engineering or operator workstations. The sources do not say which configurations are exposed beyond the affected versions, so treat all installs of those versions as in scope.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4586,"output_tokens":517,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Siemens ProductCERT advisory for WinCC fixed versions and mitigations; NVD text gives none.","search":"'-2026':13A,16A '-59082':14A,17A 'activ':41B,95C 'affect':36B,91C 'allow':102C 'arbitrari':68B,110C 'attack':7A,51B,104C 'code':8A,69B,111C 'content':42B,96C 'control':29B 'could':101C 'craft':59B 'cve':12A,15A 'devic':66B,92C,114C 'execut':67B,94C,109C 'file':5A,49B,60B,99C 'get':53B 'identifi':74C 'implicit':43B,93C 'industri':28B 'industrial-control':27B 'infrastructur':30B 'machin':11A 'make':62B,106C 'open':4A,47B,57B,98C 'run':6A,40B 'siemen':1A,31B 'simat':2A,33B,37B,76C,81C,86C 'simatic':18A,21A,24A 'simatic-wincc':32B 'user':46B,55B,64B,108C 'v7.5':20A,78C 'v8.0':23A,83C 'v8.1':26A,88C 'version':39B,80C,85C,90C 'vulner':71C 'wincc':3A,19A,22A,25A,34B,38B,77C,82C,87C 'window':35B","nicknames":[],"mitigations":[],"who_affected":"Industrial and plant operators running SIMATIC WinCC V7.5, V8.0 or V8.1 on engineering or operator workstations. The sources do not say which configurations are exposed beyond the affected versions, so treat all installs of those versions as in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["simaticwinccv75","simaticwinccv80","simaticwinccv81","winccv75","winccv80","winccv81"],"ptokens":["simatic","v7","v8","wincc"],"labels":["high","industrialcontrol","infrastructure","siemens","simaticwincc","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59082':14A,17A 'attack':7A 'code':8A 'cve':12A,15A 'file':5A 'machin':11A 'open':4A 'run':6A 'siemen':1A 'simat':2A 'simatic':18A,21A,24A 'v7.5':20A 'v8.0':23A 'v8.1':26A 'wincc':3A,19A,22A,25A","search_b":"'activ':41B 'affect':36B 'arbitrari':68B 'attack':51B 'code':69B 'content':42B 'control':29B 'craft':59B 'devic':66B 'execut':67B 'file':49B,60B 'get':53B 'implicit':43B 'industri':28B 'industrial-control':27B 'infrastructur':30B 'make':62B 'open':47B,57B 'run':40B 'siemen':31B 'simat':33B,37B 'simatic-wincc':32B 'user':46B,55B,64B 'version':39B 'wincc':34B,38B 'window':35B","search_c":"'activ':95C 'affect':91C 'allow':102C 'arbitrari':110C 'attack':104C 'code':111C 'content':96C 'could':101C 'devic':92C,114C 'execut':94C,109C 'file':99C 'identifi':74C 'implicit':93C 'make':106C 'open':98C 'simat':76C,81C,86C 'user':108C 'v7.5':78C 'v8.0':83C 'v8.1':88C 'version':80C,85C,90C 'vulner':71C 'wincc':77C,82C,87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productcert@siemens.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59082","severity":null,"published_at":"2026-11-10T12:17:20+00:00","modified_at":"2026-11-10T12:17:20+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-59082:2446","url":null,"severity":null,"published_at":"2026-11-10T12:23:58+00:00","modified_at":"2026-11-10T12:23:58+00:00","first_seen_at":"2026-11-10T12:23:58+00:00","fetched_at":"2026-11-10T12:23:58+00:00","note":"No Siemens ProductCERT advisory for CVE-2026-59082 found yet (published today; absent from notcve Siemens CSAF list, searches return only SSA-550198, which is a different CVE-2026-59241). Affected versions per NVD text only (V7.5, V8.0, V8.1 all versions). Fix unknown: recheck Siemens ProductCERT for the SSA covering this CVE. Nothing verified; fix_status left as is, unsupported by a vendor page."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}