Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Industrial control advisorySeverity 8.2 high

Siemens Desigo CC family

ICSA-26-265-05 · CISA · September 8, 2026

Summary

A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.

From CISA, quoted as published. Check the source before acting.

What to do

Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration. Currently no fix is available

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2026-342238.2 highNo0.2%Improper Control of Generation of Code (CWE-94)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
SiemensDesigo CC family V6vers:all/*—
SiemensDesigo CC family V7vers:all/*—
SiemensDesigo CC family V8——
SiemensDesigo CC family V9——

Why it's on these mode pages

  • Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. September 8, 2026: Publication Date
  2. September 22, 2026: Initial CISA Republication of Siemens ProductCERT SSA-330084 advisory
  3. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com