noindex and left out of the sitemap until more data is confirmed.CVE-2026-89199 is an authorization-bypass flaw in Siemens RUGGEDCOM CROSSBOW, the OT remote-access management platform for substation and rail devices, that lets an authenticated attacker query the underlying database for administrative credentials to other internal systems; NVD has not yet completed its own CVSS scoring or CPE analysis, so this page is held as noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-89199 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW | — | All versions before V6.0 (fixed in V6.0) |
What this means
CVE-2026-89199 (CWE-639, authorization bypass through user-controlled key) is one of eleven vulnerabilities (CVE-2026-89196 through CVE-2026-89206) that Siemens disclosed together in advisory SSA-508506 for RUGGEDCOM CROSSBOW, a management platform used to configure and control remote access to substation automation and rail OT devices. For this specific CVE, "[a]ffected devices do not properly restrict access to sensitive configuration items via specific database queries," which "could allow an authenticated attacker to retrieve administrative credentials for various internal systems," leading to unauthorized information disclosure and privilege escalation (Siemens Security Advisory SSA-508506).
Siemens scores CVE-2026-89199 at CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 8.7 — network-reachable, low complexity, requiring only low (authenticated) privileges and no user interaction, with high impact to confidentiality, integrity and availability. NVD's own description matches this Siemens text, but the CVE's NVD status is "Awaiting Analysis" as of 2026-10-26: NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score and cpe unset rather than presenting the Siemens-submitted figures as NVD-confirmed (NVD).
SSA-508506 as a whole describes RUGGEDCOM CROSSBOW as containing "multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive" data, or bypass authorization checks across its eleven listed CVEs (SQL injection, authorization bypass, a client-side template-injection flaw, and an information-disclosure issue, ranging CVSS v3.1 4.3–8.8). All affect RUGGEDCOM CROSSBOW versions before V6.0, and Siemens' fix for every CVE in the advisory is to update to V6.0 or later (CISA ICS Advisory ICSA-26-295-12).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00249 (16.073th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing. In the meantime, RUGGEDCOM CROSSBOW operators should update to V6.0 or later and review which internal credentials the platform's database can reach.
Evidence
- Insufficient restriction on sensitive configuration items via database queries lets an authenticated attacker retrieve administrative credentials for other internal systems (CWE-639). — Siemens Security Advisory SSA-508506
- Siemens scores this CVE at CVSS v3.1 8.8 (high) / v4.0 8.7; NVD status is "Awaiting Analysis" with no NVD-published score or CPE configuration as of 2026-10-26. — NVD
- SSA-508506 lists 11 related CVEs (SQL injection, authorization bypass, template injection, information disclosure) in RUGGEDCOM CROSSBOW before V6.0; fixed in V6.0. — CISA ICS Advisory ICSA-26-295-12
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00249 (16.073th percentile) as of 2026-10-26. — FIRST EPSS
