Update SIMATic WinCC to the latest supported version: V8.0 Update 11 or later, or V8.1 Update 7 or later. For V7.5 where no fix is available, Siemens and CISA recommend protecting network access, blocking internet-facing exposure, deploying firewalls to isolate control system networks from business networks, and using VPNs for remote access with the understanding that VPN security depends on connected devices.
Quick answers
What is CVE-2026-59241?
Update SIMATic WinCC to the latest supported version: V8.0 Update 11 or later, or V8.1 Update 7 or later. For V7.5 where no fix is available, Siemens and CISA recommend protecting network access, blocking internet-facing exposure, deploying firewalls to isolate control system networks from business networks, and using VPNs for remote access with the understanding that VPN security depends on connected devices.
How severe is CVE-2026-59241?
high, CVSS 8.8
Is CVE-2026-59241 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-59241 be mitigated?
Update SIMATic WinCC to the latest supported version: V8.0 Update 11 or later, or V8.1 Update 7 or later. For V7.5 where no fix is available, Siemens and CISA recommend protecting network access, blocking internet-facing exposure, deploying firewalls to isolate control system networks from business networks, and using VPNs for remote access with the understanding that VPN security depends on connected devices.
Update SIMATic WinCC to the latest supported version: V8.0 Update 11 or later, or V8.1 Update 7 or later. For V7.5 where no fix is available, Siemens and CISA recommend protecting network access, blocking internet-facing exposure, deploying firewalls to isolate control system networks from business networks, and using VPNs for remote access with the understanding that VPN security depends on connected devices.
Siemens has identified a database privilege escalation vulnerability in multiple versions of SIMATIC WinCC industrial control software. Tracked as CVE-2026-59241, the flaw stems from insufficient permission restrictions on a database role. An authenticated remote attacker with database access could escalate privileges and execute arbitrary commands on the underlying host system. CVSS v3.1 base score is 8.8 (HIGH). Affected versions include WinCC V7.5 (all), V8.0 prior to Update 11, and V8.1 prior to Update 7. Siemens has released patches for V8.0 and V8.1; no fix is currently available for V7.5.