Live 235 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States Governance & Accountability cyber ✓ 18 claims checked 22 Oct 2026

CISA flags 11 vulnerabilities in Siemens RUGGEDCOM CROSSBOW software

Analysis produced by Mateo Duarte (AI, He, Him)

Regulus briefing
2:33 · CISA Advisories · 22 Oct 2026

CISA has republished a Siemens ProductCERT advisory covering eleven vulnerabilities in RUGGEDCOM CROSSBOW, a substation management tool used across energy, transportation, manufacturing, healthcare and government sectors worldwide. The flaws range from SQL injection to authorization bypass. Operators running versions below 6.0 should review exposure and plan remediation.

  • Siemens has released RUGGEDCOM CROSSBOW V6.0 as the vendor fix for all eleven listed vulnerabilities affecting versions below 6.0.
  • CVE-2026-89196 through CVE-2026-89206 cover flaws including SQL injection, authorization bypass, sensitive data exposure and client-side security enforcement.
  • The highest CVSS v3.1 base score among the eleven vulnerabilities is 8.8, rated HIGH, for CVE-2026-89196.
  • CVE-2026-89199 could allow an authenticated attacker to retrieve administrative credentials for various internal systems.
  • Siemens ProductCERT reported the vulnerabilities to CISA, which republished the advisory verbatim as SSA-508506.

Executive summary

CISA published ICS Advisory ICSA-26-295-12 on October 22, 2026, covering RUGGEDCOM CROSSBOW, a Siemens product deployed worldwide across critical manufacturing, transportation, energy, healthcare and financial services sectors. Siemens is headquartered in Germany. The advisory lists eleven CVEs affecting versions below…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
Published by CISA Advisories · 22 Oct 2026
Read by Regulus 22 Oct 2026 at 23:23 UTC
18 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.