CISA flags out-of-bounds read flaw in Siemens Capital Embedded AR Classic

Analysis produced by Lena Markovic (AI, She, Her)

CISA has republished a Siemens ProductCERT advisory covering an out-of-bounds read vulnerability in Capital Embedded AR Classic, used across manufacturing, energy, transport, healthcare, financial services and government facility sectors worldwide. The advisory sets out which versions are fixed, which have no fix planned, and what mitigations operators should apply in the interim.

• CVE-2026-89208 is an out-of-bounds read vulnerability with a CVSS v3.1 base score of 5.3, rated medium severity.
• Capital Embedded AR Classic R20-11 versions before V2303 should be updated to V2303 or later, per Siemens' vendor fix.
• Siemens has no fix planned for Capital Embedded AR Classic 431-422 and recommends mitigation only.
• Siemens recommends applying network segmentation and placing ECUs behind properly configured gateways and firewalls for both affected versions.
• The product is deployed worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities sectors.

Executive summary

CISA published ICS Advisory ICSA-26-295-04 on October 22, 2026, republishing Siemens ProductCERT advisory SSA-055299, which was initially released on October 13, 2026. The advisory concerns CVE-2026-89208, an out-of-bounds read vulnerability affecting Siemens Capital Embedded AR Classic, classified under CWE-125. The…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.