Security Advisory

CVE-2026-44415: Siemens Edge Path Traversal (pending)

Last updated:
  • CVE-2026-44415
Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-44415 is a path-traversal weakness that lets an authenticated remote attacker on Siemens Industrial Edge devices and related SIMATIC HMI/IPC products reach internal APIs and paths they should not, exposing sensitive internal information and, in the worst case, enabling unauthorized system access or data deletion; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.

Vulnerability summary

N/A

Not yet scored

0.5%

EPSS score (FIRST)

No

CISA KEV catalog

2026-10-13

Published

Vulnerability ID: CVE-2026-44415 · Source: NVD

Affected components

ComponentCPEVersion range
Siemens Industrial Edge devices (Cloud/Own/Virtual), SCALANCE LPE9413/LPE9433, SIMATIC HMI MTP series, SIMATIC IoT2050, SIMATIC IPC Industrial Edge Devices—Industrial Edge Cloud/Own/Virtual Devices before V1.28.1; SCALANCE LPE9413/LPE9433 all versions; SIMATIC HMI MTP 700/1000/1200/1500/1900/2200 all versions; SIMATIC IoT2050 before V1.28.1-2; SIMATIC IPC BX/E-series Industrial Edge Devices before V3.2.0-17; fixed in V1.28.1, V1.28.1-2 or V3.2.0-17 depending on product, where available; not yet a published NVD CPE applicability statement

What this means

CVE-2026-44415 (CWE-35, path traversal) affects Siemens Industrial Edge devices and a family of related SIMATIC products. NVD's description states: "Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data" (NVD).

NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-22: it records Siemens' own CNA-submitted CVSS v3.1 score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, and CVSS v4.0 score of 8.9 (high), but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting Siemens' figure as NVD-confirmed (NVD).

Siemens' own advisory SSA-832641, published 2026-10-13, bundles this CVE with a related, lower-severity path-traversal issue (CVE-2026-44414, CVSS v3.1 6.8) in the same affected products: Industrial Edge Cloud/Own/Virtual Devices before V1.28.1, SCALANCE LPE9413/LPE9433 (all versions), the SIMATIC HMI MTP 700/1000/1200/1500/1900/2200 panel family (all versions), SIMATIC IoT2050 before V1.28.1-2, and SIMATIC IPC BX/E-series Industrial Edge Devices before V3.2.0-17. Siemens recommends updating to the fixed versions where available, and for products without an available fix — including the SIMATIC HMI MTP panels — restricting network access to the affected products to trusted parties only (Siemens Security Advisory SSA-832641).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00462 (39.0th percentile) (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of the affected Industrial Edge and SIMATIC products should apply Siemens' available updates and restrict network access to trusted parties where no fix yet exists.

How to fix this class of issueThis advisory's weakness class is Path traversal. Our practical guide covers how to detect, fix, verify and disclose it: How to fix path traversal in embedded firmware.

Evidence

  • Affected systems do not properly restrict access to internal APIs and paths for authenticated users, allowing access to sensitive internal information and, worst case, unauthorized system access or data deletion (CWE-35). — NVD
  • NVD status is "Awaiting Analysis" with Siemens-submitted CVSS v3.1 9.1 (vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 8.9, no NVD-published score or CPE configuration as of 2026-10-22. — NVD
  • Affects Industrial Edge Cloud/Own/Virtual Devices before V1.28.1, SCALANCE LPE9413/LPE9433, SIMATIC HMI MTP panel family, SIMATIC IoT2050 before V1.28.1-2, SIMATIC IPC BX/E-series before V3.2.0-17; also bundles related CVE-2026-44414. Fixes available for some products; HMI MTP panels have no fix, mitigate via network access restriction. — Siemens Security Advisory SSA-832641
  • Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
  • EPSS score is 0.00462 (39.0th percentile) as of 2026-10-22. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2026-48282: Adobe ColdFusion Path Traversal RCE (KEV, exploited)CISA KEVCVE-2026-48282: KEV path traversal in Adobe ColdFusion leads to arbitrary code execution, exploited in the wild in limited attacks. Sourced to NVD, CISA KEV, Adobe.CVE-2026-59310: Broadcom VMware vCenter Syslog Path Traversal RCE (KEV)CISA KEVCVE-2026-59310: KEV directory-traversal bug in VMware vCenter's Syslog server lets a network attacker execute arbitrary code; exploited by a suspected China-nexus group. Sourced to NVD, Broadcom, CISA KEV, EPSS.CVE-2026-76519: Cisco Secure Email Gateway RCECISA KEVCVE-2026-76519: KEV critical file-write RCE in Cisco Secure Email Gateway AMP scanning. Patch, versions, scoring, sourced to NVD, CISA and Cisco.

Sources

  1. NVD
  2. Siemens Security Advisory SSA-832641
  3. CISA KEV
  4. FIRST EPSS