Siemens recommends upgrading affected SIMATIC IPC firmware to the following minimum versions: SIMATIC IPC BX-21A >= V31.01.13, SIMATIC IPC RW-543A >= V1.1.4, SIMATIC IPC227G/277G/277G PRO/327G/377G >= V28.01.15. After upgrading, users must load BIOS default settings and re-provision Secure Boot keys if previously provisioned. As a temporary mitigation, users can manually remove the test key from the UEFI Secure Boot database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A), noting that loading default settings will restore the test key.
Quick answers
What is CVE-2026-72895?
Siemens recommends upgrading affected SIMATIC IPC firmware to the following minimum versions: SIMATIC IPC BX-21A >= V31.01.13, SIMATIC IPC RW-543A >= V1.1.4, SIMATIC IPC227G/277G/277G PRO/327G/377G >= V28.01.15. After upgrading, users must load BIOS default settings and re-provision Secure Boot keys if previously provisioned. As a temporary mitigation, users can manually remove the test key from the UEFI Secure Boot database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A), noting that loading default settings will restore the test key.
How severe is CVE-2026-72895?
high, CVSS 7.7
Is CVE-2026-72895 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-72895 be mitigated?
Siemens recommends upgrading affected SIMATIC IPC firmware to the following minimum versions: SIMATIC IPC BX-21A >= V31.01.13, SIMATIC IPC RW-543A >= V1.1.4, SIMATIC IPC227G/277G/277G PRO/327G/377G >= V28.01.15. After upgrading, users must load BIOS default settings and re-provision Secure Boot keys if previously provisioned. As a temporary mitigation, users can manually remove the test key from the UEFI Secure Boot database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A), noting that loading default settings will restore the test key.
Siemens recommends upgrading affected SIMATIC IPC firmware to the following minimum versions: SIMATIC IPC BX-21A >= V31.01.13, SIMATIC IPC RW-543A >= V1.1.4, SIMATIC IPC227G/277G/277G PRO/327G/377G >= V28.01.15. After upgrading, users must load BIOS default settings and re-provision Secure Boot keys if previously provisioned. As a temporary mitigation, users can manually remove the test key from the UEFI Secure Boot database (e.g., "DO NOT TRUST - AMI Test PK" for RW-543A or "insyde-ElkhartLake" for IPC227G/277G/327G/377G and BX-21A), noting that loading default settings will restore the test key.
Siemens has identified a vulnerability in SIMATIC IPC industrial control products where a BIOS vendor test key is embedded in the UEFI Secure Boot key database. Tracked as CVE-2026-72895 with a CVSS v3.1 base score of 7.7 (HIGH), the flaw could allow a local attacker with physical or administrative access to boot an operating system or UEFI application signed with that test key, bypassing Secure Boot protections even when enabled. Siemens has released updated firmware versions for all affected models and recommends immediate upgrading as the definitive remediation.