noindex and left out of the sitemap until more data is confirmed.CVE-2026-89196 is a SQL injection flaw in how Siemens RUGGEDCOM CROSSBOW's Bulk Import/Export workflow handles facility names, letting a privileged authenticated user run arbitrary SQL against the underlying database; it is the most severe of 11 CVEs Siemens disclosed for CROSSBOW on the same day, and NVD has not yet completed its own CVSS scoring or CPE analysis, so this page is held as noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-89196 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW | — | All versions prior to V6.0 (fixed in V6.0); affects the Bulk Import/Export facility-name handling specifically, one of 11 CVEs (CVE-2026-89196 through CVE-2026-89206) disclosed for RUGGEDCOM CROSSBOW < V6.0 in the same advisory; not yet a published NVD CPE applicability statement. |
What this means
CVE-2026-89196 (CWE-89, SQL injection) affects Siemens RUGGEDCOM CROSSBOW, a secure remote-access management solution used in substation and OT networks. NVD's description, drawn from Siemens' own CVE record, states: "Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-23: it records Siemens' own CVSS v3.1 submission of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 8.7, but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting Siemens' figure as NVD-confirmed (NVD).
Siemens' Security Advisory SSA-508506, published 2026-10-13, bundles CVE-2026-89196 with ten further CVEs in RUGGEDCOM CROSSBOW versions before V6.0 — further SQL-injection issues in notification-condition and firmware-filename handling (CVE-2026-89197, CVE-2026-89198, both also 8.8), an authorization bypass exposing credentials (CVE-2026-89199, 8.8), lower-severity SQL-injection and denial-of-service issues (CVE-2026-89200 through CVE-2026-89202, 6.3–7.5), and several information-disclosure and unauthorized-configuration-access issues scored 4.3–6.3 (CVE-2026-89203 through CVE-2026-89206) — all fixed in RUGGEDCOM CROSSBOW V6.0 (Siemens Security Advisory SSA-508506).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-23, and FIRST scores the probability of exploitation at 0.0042 (35.281st percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, RUGGEDCOM CROSSBOW operators should update to V6.0, which fixes all 11 CVEs disclosed in SSA-508506.
Evidence
- Unsanitized facility-name input in the Bulk Import/Export workflow lets an authenticated attacker with specific privileges execute arbitrary SQL commands on the underlying database (CWE-89). — NVD
- NVD status is "Awaiting Analysis" with Siemens-submitted CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 8.7; no NVD-published score or CPE configuration as of 2026-10-23. — NVD
- Bundled with ten further CVEs (CVE-2026-89197 through CVE-2026-89206, scores 4.3–8.8) affecting RUGGEDCOM CROSSBOW < V6.0; all fixed in V6.0. — Siemens Security Advisory SSA-508506
- Not present in the CISA KEV catalog as of 2026-10-23. — CISA KEV
- EPSS score is 0.0042 (35.281st percentile) as of 2026-10-23. — FIRST EPSS
