noindex and left out of the sitemap until more data is confirmed.CVE-2026-59241 is a database privilege-escalation vulnerability in Siemens SIMATIC WinCC: because the application does not sufficiently restrict the permissions assigned to a database role, an authenticated remote attacker who already has database access can escalate privileges and run arbitrary commands on the WinCC host, potentially compromising the whole system; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-59241 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC WinCC | — | WinCC V7.5, all versions (no fix available); WinCC V8.0 before Update 11 (fixed in V8.0 Update 11); WinCC V8.1 before Update 7 (fixed in V8.1 Update 7); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-59241 (CWE-266, incorrect privilege assignment) affects Siemens SIMATIC WinCC, a SCADA/HMI visualization system widely used in industrial control environments. NVD's description states: "A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system" (NVD).
NVD tracks the CVE with status "Deferred" as of 2026-10-22: it records Siemens' own CNA-submitted CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 score of 8.7 (high), but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting Siemens' figure as NVD-confirmed (NVD).
Siemens' advisory SSA-550198, published 2026-10-13, confirms WinCC V7.5 (all versions) has no fix currently available, while WinCC V8.0 is fixed in V8.0 Update 11 and WinCC V8.1 is fixed in V8.1 Update 7; for V7.5 and otherwise unpatched hosts, Siemens recommends restricting network access to the database and following its standard industrial-security operational guidelines (Siemens Security Advisory SSA-550198).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00499 (41.9th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, WinCC operators should update V8.0 and V8.1 installs to the fixed updates, and on V7.5 (and any host pending an update) restrict network and credential access to the WinCC database to trusted administrators only.
Evidence
- WinCC does not sufficiently restrict permissions assigned to a database role, letting an authenticated remote attacker with database access escalate privileges and execute arbitrary commands on the host (CWE-266). — NVD
- NVD status is "Deferred" with Siemens-submitted CVSS v3.1 8.8 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.7, no NVD-published score or CPE configuration as of 2026-10-22. — NVD
- Affects WinCC V7.5 (all versions, no fix available), V8.0 before Update 11 (fixed in Update 11), V8.1 before Update 7 (fixed in Update 7). — Siemens Security Advisory SSA-550198
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.00499 (41.9th percentile) as of 2026-10-22. — FIRST EPSS
