Full Report
Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.
Analysis Summary
# Vulnerability: Authenticated Remote Code Execution in SIMATIC WinCC
## CVE Details
- **CVE ID:** CVE-2026-59241
- **CVSS Score:** 8.8 (High) [v3.1] / 8.7 (High) [v4.0]
- **CWE:** CWE-266: Incorrect Privilege Assignment
## Affected Systems
- **Products:** SIMATIC WinCC (SCADA System)
- **Versions:**
- **SIMATIC WinCC V7.5:** All versions
- **SIMATIC WinCC V8.0:** All versions prior to V8.0 Update 11
- **SIMATIC WinCC V8.1:** All versions prior to V8.1 Update 7
- **Configurations:** Systems where an authenticated user has direct access to the underlying database.
## Vulnerability Description
The vulnerability stems from insufficient restriction of permissions assigned to specific database roles within the SIMATIC WinCC environment. An authenticated remote attacker who has obtained access to the database can exploit these excessive privileges to escalate their authority. This escalation allows for the execution of arbitrary commands on the underlying host operating system, effectively leading to full system compromise.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC status not explicitly stated, but technical details suggest high reproducibility for authenticated users.
- **Complexity:** Low
- **Attack Vector:** Network (Authenticated)
## Impact
- **Confidentiality:** High (Full access to host data)
- **Integrity:** High (Ability to modify system files and commands)
- **Availability:** High (Potential for complete system shutdown or disruption)
## Remediation
### Patches
Siemens recommends updating to the following versions:
- **SIMATIC WinCC V8.0:** Update to **V8.0 Update 11** or later.
- **SIMATIC WinCC V8.1:** Update to **V8.1 Update 7** or later.
### Workarounds
For **SIMATIC WinCC V7.5** (where no fix is currently available) and other versions awaiting patches:
- Restrict database access to the absolute minimum necessary users and services.
- Follow Siemens' operational guidelines for Industrial Security to isolate the SCADA environment.
- Implement strict network segmentation to ensure the database layer is not exposed to untrusted networks.
## Detection
- **Indicators of Compromise:** Monitor for unusual command execution (cmd.exe, powershell.exe) originating from database service accounts (e.g., SQL Server process).
- **Detection Methods:** Audit database logs for unauthorized privilege escalation attempts or the use of extended stored procedures (like `xp_cmdshell`) by non-administrative users.
## References
- **Vendor Advisory:** [https://cert-portal.siemens.com/productcert/html/ssa-550198.html](https://cert-portal.siemens.com/productcert/html/ssa-550198.html)
- **Siemens Industrial Security Guidelines:** [https://www.siemens.com/cert/operational-guidelines-industrial-security](https://www.siemens.com/cert/operational-guidelines-industrial-security)
- **WinCC V8.0 Update 11 Support:** [https://support.industry.siemens.com/cs/ww/en/view/109818723/](https://support.industry.siemens.com/cs/ww/en/view/109818723/)
- **WinCC V8.1 Update 7 Support:** [https://support.industry.siemens.com/cs/ww/en/view/109977191/](https://support.industry.siemens.com/cs/ww/en/view/109977191/)