CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software
CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.
- Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
- CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
- The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
- CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
- Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.