Security Advisory

CVE-2026-89202: Siemens RUGGEDCOM CROSSBOW Missing Authorization on Device Disconnect (pending)

Last updated: 2026-10-27

CVE-2026-89202

Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-89202 is a missing authorization check (CWE-639) in Siemens RUGGEDCOM CROSSBOW that lets an authenticated attacker with only minimal privileges send device-disconnection requests on behalf of other users, forcibly disconnecting their active sessions — including administrators — for a denial-of-service effect; NVD has not yet published its own analysis, so this page stays noindex until that analysis lands.

Vulnerability summary

N/A

Not yet scored

0.2%

EPSS score (FIRST)

CISA KEV catalog

2026-10-13

Published

Vulnerability ID: CVE-2026-89202 · Source: NVD

Affected components

Component	CPE	Version range
Siemens RUGGEDCOM CROSSBOW	—	All versions before V6.0 (fixed in V6.0 or later)

What this means

CVE-2026-89202 affects Siemens RUGGEDCOM CROSSBOW, a station access and asset-management platform used to centrally control remote access to RUGGEDCOM and other substation/OT devices. NVD's description states: "affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service" (NVD).

NVD's status for this CVE is "Awaiting Analysis" as of 2026-10-27, so there is no NVD-published CVSS score yet. The only severity figures on record are Siemens' own CNA submission: CVSS v3.1 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, and CVSS v4.0 7.1 (high) — the vendor's scores, not NVD-confirmed, so this page leaves cvss_score unset rather than present them as NVD's own figure (NVD).

Siemens' own security advisory SSA-508506 (published 2026-10-13) confirms the CWE-639 classification, lists RUGGEDCOM CROSSBOW versions before V6.0 as affected, and gives V6.0 or later as the fix — it is one of eleven CVEs patched together in that release, ranging up to CVSS v3.1 8.8 for the most severe (SQL-injection-class) issues in the same advisory; the advisory offers no vulnerability-specific workaround beyond upgrading and following Siemens' general operational-security guidance for industrial networks (Siemens Security Advisory SSA-508506).

CISA republished the same advisory as ICSA-26-295-12 on 2026-10-22, affecting Critical Manufacturing sector deployments worldwide, and recommends the standard network-exposure mitigations: minimise network exposure for control-system devices, isolate them behind firewalls away from business networks, and use a VPN for any required remote access (CISA ICS Advisory ICSA-26-295-12).

CVE-2026-89202 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00217 (12.085th percentile) (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators running RUGGEDCOM CROSSBOW before V6.0 should upgrade to V6.0 or later and restrict who can reach the CROSSBOW management interface.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

Missing authorization check on device disconnection requests lets a minimally privileged authenticated attacker disconnect other users' sessions, including administrators, causing a denial-of-service condition (CWE-639). — NVD
NVD status is "Awaiting Analysis" as of 2026-10-27; only Siemens CNA scores exist: CVSS v3.1 6.5 (medium, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and CVSS v4.0 7.1 — not NVD-published. — NVD
Fixed in RUGGEDCOM CROSSBOW V6.0 or later, patched together with 10 other CVEs in the same release; no vulnerability-specific workaround beyond upgrading. — Siemens Security Advisory SSA-508506
Republished by CISA as ICSA-26-295-12 on 2026-10-22, affecting Critical Manufacturing sector deployments worldwide. — CISA ICS Advisory ICSA-26-295-12
Not present in the CISA KEV catalog as of 2026-10-27; EPSS score is 0.00217 (12.085th percentile) as of 2026-10-27. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan report Track this CVE Chat with David on WhatsApp

Talk to an expert

Huy Nguyen (David)

Founder & CEO, Netbase JSC

WhatsApp [email protected]

Related advisories

CVE-2026-89204: Siemens RUGGEDCOM CROSSBOW Subnet-Management Authorization Bypass (pending)CVE-2026-89204: RUGGEDCOM CROSSBOW fails to restrict access to the database queries used for subnet management, letting an authenticated attacker read, modify or delete subnet configurations. NVD has not yet scored it (Awaiting Analysis) and it is not on CISA KEV, so this page is pending.CVE-2026-92414: Apache Jackrabbit WebDAV Session Fixation via Derivable Lock TokensCVE-2026-92414: NVD-Analyzed (Primary CVSS 9.1) session-fixation flaw in Apache Jackrabbit's WebDAV server attaches a cached authenticated session to any request matching a Lock-Token/TransactionId/SubscriptionId/If-header token, with no credential check. Sourced to NVD, Apache Jackrabbit security announcement and FIRST EPSS.CVE-2026-92817: Ignition Perspective Escalation (pending)CVE-2026-92817: Ignition Perspective session flaw may let a Vision user gain Designer privileges. NVD analysis incomplete, page stays noindex pending review.