Home / Items
Industrial control advisorySeverity 9.0 critical
Siemens Siveillance Control
ICSA-26-265-03 · CISA · September 8, 2026
Summary
A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access on the OIS server.
Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.
From CISA, quoted as published. Check the source before acting.
What to do
Update to V3.0.12.2173 or later version
Update to V3.0.22.2177 or later version
Update to V4.0.11.2177 or later version
Update to V4.0.9.2178 or later version
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-50093 | 9.0 critical | No | 0.3% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Siemens | Siveillance Control Pro V3.0 |
| Siemens | Siveillance Control Pro V4.0 |
| Siemens | Siveillance Control V3.0 |
| Siemens | Siveillance Control V4.0 |
Why it's on these mode pages
- Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- September 8, 2026: Publication Date
- September 22, 2026: Initial CISA Republication of Siemens ProductCERT SSA-254516 advisory
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com