CVE-2026-72895: Siemens SIMATIC Industrial PC BIOS Test Key Bypasses UEFI Secure Boot (pending)

CVE-2026-72895 is a leftover BIOS vendor test key in the UEFI Secure Boot key database of several Siemens SIMATIC industrial PC models, letting a local attacker boot test-signed operating system or firmware code and bypass Secure Boot protections even when Secure Boot is enabled; NVD has not published its own CVSS score for this vendor-reported vulnerability.

CVE-2026-72895 affects three Siemens SIMATIC industrial PC (IPC) model families: SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, and the SIMATIC IPC227G/277G/277G PRO/327G/377G line — ruggedized industrial computers used for HMI, edge and control applications inside manufacturing and process environments. NVD's description states: "A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device" (CWE-1394, Use of Default Cryptographic Key) (NVD).

Siemens ProductCERT's own CSAF advisory names the specific leftover test keys per model: "DO NOT TRUST - AMI Test PK" on the RW-543A, and "insyde-ElkhartLake" on the IPC227G/277G/327G/377G family and the BX-21A. These are vendor/BIOS-tooling test keys rather than attacker-controlled or malware-planted keys, any party who can obtain a certificate signed by the corresponding (not-secret-enough) test key can sign boot code the device will trust (Siemens Security Advisory SSA-159454).

CVE-2026-72895's NVD status is "Deferred" as of 2026-10-31, so there is no NVD-published Primary score. Siemens ProductCERT's own CNA submission rates it CVSS v3.1 7.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and CVSS v4.0 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), both stored by NVD as Secondary, not NVD-confirmed; both vectors reflect that the attack requires local access and some user interaction/physical presence rather than being remotely exploitable (NVD).

Fixes are available for all three affected lines: SIMATIC IPC RW-543A V1.1.4 or later, SIMATIC IPC227G/277G/277G PRO/327G/377G V28.01.15 or later, and SIMATIC IPC BX-21A V31.01.13 or later. Siemens' advisory warns that after flashing the fixed BIOS, operators must reload BIOS default settings, and if Secure Boot keys were already provisioned they must be re-provisioned afterward. As an interim mitigation for devices that cannot be updated right away, Siemens describes manually removing the specific test key from the Secure Boot key database, while cautioning that reloading BIOS defaults will restore the test key, making the BIOS update the only durable fix (Siemens Security Advisory SSA-159454).

Siemens ProductCERT reported this vulnerability to CISA itself rather than crediting an external researcher. CISA's advisory lists the affected sectors as Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services and Government Services and Facilities, with Siemens headquartered in Germany and deployment worldwide (CISA ICS Advisory ICSA-26-295-07).

As of 2026-10-30, CVE-2026-72895 is not listed in the CISA Known Exploited Vulnerabilities catalog, and FIRST scores the probability of exploitation at 0.00107 (1.1th percentile) as of 2026-10-31, consistent with a bug that requires local or physical access before it can be used (CISA KEV, FIRST EPSS).

Because NVD has not completed its own severity analysis. In the meantime, operators of the affected SIMATIC IPC models should update to the fixed BIOS versions and re-provision Secure Boot keys afterward, restricting physical and administrative access to the devices until that update is applied.

• A BIOS vendor test key present in the UEFI Secure Boot key database lets a local attacker with physical or administrative access boot test-signed OS/UEFI code, bypassing Secure Boot even when enabled, with potential full loss of confidentiality, integrity and availability (CWE-1394). — NVD
• Named test keys are "DO NOT TRUST - AMI Test PK" (RW-543A) and "insyde-ElkhartLake" (IPC227G/277G/327G/377G and BX-21A); interim mitigation is manual key removal, but reloading BIOS defaults restores the test key. — Siemens Security Advisory SSA-159454
• No NVD Primary score; Siemens ProductCERT's own CNA submission is CVSS v3.1 7.7 (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and CVSS v4.0 8.4, both Secondary/not NVD-confirmed. — NVD
• Fixes available: RW-543A V1.1.4+, IPC227G/277G/277G PRO/327G/377G V28.01.15+, BX-21A V31.01.13+; after flashing, operators must reload BIOS defaults and re-provision Secure Boot keys. Siemens ProductCERT reported the issue to CISA itself; affects Critical Manufacturing, Transportation, Energy, Healthcare, Financial Services and Government sectors worldwide. — CISA ICS Advisory ICSA-26-295-07
• Not present in the CISA KEV catalog as of 2026-10-30; EPSS score is 0.00107 (1.1th percentile) as of 2026-10-31. — FIRST EPSS