---
id: "CVE-2026-59082"
page: "https://infrastack.ai/live/CVE-2026-59082"
kind: "vulnerability"
aliases: ["CVE-2026-59082"]
title: "Siemens SIMATIC WinCC: opening files runs attacker code on the machine"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SIMATIC WinCC V7.5", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}, {"name": "SIMATIC WinCC V8.0", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}, {"name": "SIMATIC WinCC V8.1", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["industrial-control", "infrastructure", "siemens", "simatic-wincc", "windows"]
not_affected_if: []
published_at: "2026-11-10T12:17:20+00:00"
first_seen_at: "2026-11-10T12:21:54+00:00"
updated_at: "2026-11-10T12:23:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59082", "first_seen_at": "2026-11-10T12:21:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T12:23:58+00:00"}]
exploit_sources: []
---

# Siemens SIMATIC WinCC: opening files runs attacker code on the machine

Link for people: https://infrastack.ai/live/CVE-2026-59082 (this .md is for agents)

Affected SIMATIC WinCC versions run active content implicitly when a user opens a file. An attacker who gets a user to open a crafted file can make that user's device execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SIMATIC WinCC V7.5 affected all versions fixed no fixed version listed
- vendor:SIMATIC WinCC V8.0 affected all versions fixed no fixed version listed
- vendor:SIMATIC WinCC V8.1 affected all versions fixed no fixed version listed

## How to check

- Identify SIMATIC WinCC V7.5, V8.0 or V8.1 installations in the environment.
- Check the installed WinCC version against Siemens' advisory; the sources do not list fixed versions.

## Timeline

- 2026-11-10T12:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59082
- 2026-11-10T12:23:58+00:00 analyst — No Siemens ProductCERT advisory for CVE-2026-59082 found yet (published today; absent from notcve Siemens CSAF list, searches return only SSA-550198, which is a different CVE-2026-59241). Affected versions per NVD text only (V7.5, V8.0, V8.1 all versions). Fix unknown: recheck Siemens ProductCERT for the SSA covering this CVE. Nothing verified; fix_status left as is, unsupported by a vendor page.

## From the sources

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected devices implicitly execute active content when opening files. This could allow an attacker to make the user execute arbitrary code on the device.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_