noindex and left out of the sitemap until more data is confirmed.CVE-2026-44414 is a path-traversal flaw across Siemens' Industrial Edge device family and several SIMATIC IPC/IoT2050 models that lets an already-authenticated remote attacker bypass access restrictions to internal-only APIs and paths, exposing sensitive internal information; fixes exist for most affected models but not yet for SCALANCE LPE9413/LPE9433, and NVD has not completed its own CVSS scoring, so this page is held as noindex.
Vulnerability summary
N/A
Not yet scored
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-44414 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens Industrial Edge Cloud/Own/Virtual Devices; SCALANCE LPE9413/LPE9433; SIMATIC IoT2050 Advanced/SM IED; SIMATIC IPC127E/227E/227G/427E/847E/BX-21A/BX-39A/BX-59A | — | Industrial Edge Cloud/Own/Virtual Devices and SIMATIC IoT2050 Advanced/SM IED before V1.28.1 (fixed in V1.28.1 / V1.28.1-2); affected SIMATIC IPC models before V3.2.0-17 (fixed in V3.2.0-17); SCALANCE LPE9413/LPE9433 affected in all versions with no fix available yet. |
What this means
CVE-2026-44414 (CWE-35, path traversal: .../...//) affects the Siemens Industrial Edge device family. NVD's description, drawn from Siemens' own CVE record, states: "Affected devices do not properly restrict access to internal APIs and paths for authenticated users. This could allow a remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-26: it records Siemens' own CVSS v3.1 submission of 6.8 (medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, and a CVSS v4.0 score of 6.9, but has not published its own independent score, so this page leaves cvss_score unset rather than presenting Siemens' figure as NVD-confirmed (NVD).
Siemens' Security Advisory SSA-832641, published 2026-10-13, lists Industrial Edge Cloud/Own/Virtual Devices and SIMATIC IoT2050 Advanced/SM IED as fixed in V1.28.1 (V1.28.1-2 for the IoT2050), and the affected SIMATIC IPC models (127E, 227E, 227G, 427E, 847E, BX-21A, BX-39A, BX-59A) as fixed in V3.2.0-17; SCALANCE LPE9413 and LPE9433 are listed as affected in all versions with no fix yet available. The same advisory discloses a second, more severe path-traversal issue, CVE-2026-44415 (CVSS v3.1 9.1), affecting SIMATIC HMI panel and SIPLUS variants with no fix currently available (Siemens Security Advisory SSA-832641).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00468 (40.239th percentile) as of 2026-10-25 (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of affected Industrial Edge devices, SIMATIC IoT2050 or SIMATIC IPC models should update to the fixed versions above; SCALANCE LPE9413/LPE9433 operators have no fix yet and should restrict network access to trusted parties per Siemens' operational guidelines until one ships.
Evidence
- Affected devices do not properly restrict authenticated-user access to internal APIs and paths, letting a remote attacker access sensitive internal information that could facilitate further unauthorized access (CWE-35). — NVD
- NVD status is "Awaiting Analysis" with Siemens-submitted CVSS v3.1 6.8 (medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, and CVSS v4.0 6.9; no NVD-published score as of 2026-10-26. — NVD
- Fixed in Industrial Edge Cloud/Own/Virtual Devices and SIMATIC IoT2050 V1.28.1(-2) and affected SIMATIC IPC models V3.2.0-17; SCALANCE LPE9413/LPE9433 have no fix yet; a related, more severe path-traversal CVE-2026-44415 (CVSS v3.1 9.1) is disclosed in the same advisory. — Siemens Security Advisory SSA-832641
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00468 (40.239th percentile) as of 2026-10-25. — FIRST EPSS
