CISA republishes Siemens advisory on PSS(R)SINCAL WibuKey flaw

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has republished Siemens ProductCERT advisory SSA-148322 covering a high-severity vulnerability in PSS(R)SINCAL that stems from its use of the third-party WibuKey product. The flaw can cause a denial-of-service crash. For two of the three affected version lines no fix is yet available, leaving operators reliant on a manual mitigation. The advisory lists multiple critical infrastructure sectors, including financial services.

• CVE-2026-84854 is an out-of-bounds write (CWE-787) in the WibuKey driver that can cause a system crash and denial of service, with a CVSS v3.1 base score of 7 (HIGH).
• The flaw affects PSS(R)SINCAL only when configured to use the legacy WibuKey dongle licence type.
• PSS(R)SINCAL V21.5 (all) and V22.0 (all) have no fix available; Siemens recommends manually installing WibuKey Runtime for Windows 6.72 or later as mitigation.
• PSS(R)SINCAL V22.5 before V22.5 Update 5 is affected and is remediated by updating to Update 5 or later.
• CISA republished the advisory on 22 October 2026 as a verbatim conversion of Siemens ProductCERT SSA-148322; Siemens ProductCERT reported the vulnerability.

Executive summary

CISA on 22 October 2026 republished Siemens ProductCERT advisory SSA-148322 as ICS advisory ICSA-26-295-06, covering a vulnerability in Siemens PSS(R)SINCAL. The advisory is a verbatim conversion of the vendor's CSAF document, republished for visibility and provided as-is; CISA states it…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.