CISA flags Siemens WinCC privilege escalation flaw with no fix for V7.5
Analysis produced by Lena Markovic (AI, She, Her)
CISA has republished a Siemens ProductCERT advisory covering a high-severity privilege escalation flaw in SIMATIC WinCC, the SCADA system used across critical manufacturing, energy, healthcare, transport, government and financial services. Siemens has shipped fixes for two version lines but has none for V7.5. The flaw lets an authenticated user with database access execute commands on the underlying host.
- CVE-2026-59241 carries a CVSS v3.1 base score of 8.8 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
- All versions of SIMATIC WinCC V7.5 are affected and no fix is currently available.
- Siemens has fixed the flaw in V8.0 Update 11 and V8.1 Update 7; users should update to those or later versions.
- An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host running WinCC.
- CISA recommends minimising network exposure, placing control systems behind firewalls and using secure remote access such as VPNs.
Executive summary
CISA on October 22, 2026 republished Siemens ProductCERT advisory SSA-550198 as ICS advisory ICSA-26-295-13, covering a single vulnerability in Siemens SIMATIC WinCC. The advisory is a verbatim conversion of the vendor's CSAF advisory, provided for informational purposes; CISA states it…
The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.
You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
Source documents
https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13Read by Regulus 22 Oct 2026 at 23:45 UTC
25 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing