noindex and left out of the sitemap until more data is confirmed.CVE-2026-89201 is a SQL injection in the Bulk Export workflow of Siemens RUGGEDCOM CROSSBOW, caused by unsanitized device group and facility name input, that lets an authenticated attacker with specific privileges run arbitrary SQL commands against the underlying database; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-89201 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens RUGGEDCOM CROSSBOW | — | All versions before V6.0 (fixed in V6.0); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-89201 is a SQL injection vulnerability (CWE-89) in Siemens RUGGEDCOM CROSSBOW, a centralized access-management product for substation and industrial networks. NVD's description, sourced from the Siemens ProductCERT submission, states: "Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-15: it records a CNA-submitted (Siemens ProductCERT) CVSS v3.1 score of 7.5 (high), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 7.7 (high), but NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).
CISA's ICS advisory ICSA-26-295-12, published 2026-10-22, bundles this CVE with ten further RUGGEDCOM CROSSBOW flaws from the same Siemens disclosure (SSA-508506) — including three other high-severity SQL-injection bugs (CVSS 8.8) and a credential-exposure issue (CWE-639) — and states the vulnerabilities together "could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service." All eleven CVEs are fixed in RUGGEDCOM CROSSBOW V6.0; Siemens ProductCERT is credited with the report, and CISA's recommended mitigation is to minimize network exposure for control-system devices and isolate them behind firewalls from business networks (CISA ICS Advisory ICSA-26-295-12).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00236 (14.455th percentile) as of 2026-10-27 (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, RUGGEDCOM CROSSBOW operators should upgrade to V6.0 and restrict administrative access to the Bulk Export workflow to trusted, authenticated users only.
Evidence
- Unsanitized device group/facility name input in the Bulk Export workflow lets an authenticated attacker with specific privileges execute arbitrary SQL commands on the underlying database (CWE-89). — NVD
- NVD status is "Awaiting Analysis" with a CNA (Siemens ProductCERT) submitted CVSS v3.1 7.5 / v4.0 7.7; no NVD-published score or CPE configuration as of 2026-10-15. — NVD
- Bundled with ten further RUGGEDCOM CROSSBOW flaws from Siemens SSA-508506 (including other SQL-injection and credential-exposure bugs); all fixed in V6.0; no exploitation statement given. — CISA ICS Advisory ICSA-26-295-12
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00236 (14.455th percentile) as of 2026-10-27. — FIRST EPSS
