Install WIBU Systems WibuKey Runtime for Windows version 6.72 or later. PSS(R)SINCAL V22.5 users should update to V22.5 Update 5 or later. Apply network segmentation, firewall isolation, and VPN protections for control system devices. Prioritize validation of security updates before deployment.
Quick answers
What is CVE-2026-84854?
Install WIBU Systems WibuKey Runtime for Windows version 6.72 or later. PSS(R)SINCAL V22.5 users should update to V22.5 Update 5 or later. Apply network segmentation, firewall isolation, and VPN protections for control system devices. Prioritize validation of security updates before deployment.
How severe is CVE-2026-84854?
high, CVSS 7
Is CVE-2026-84854 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-84854 be mitigated?
Install WIBU Systems WibuKey Runtime for Windows version 6.72 or later. PSS(R)SINCAL V22.5 users should update to V22.5 Update 5 or later. Apply network segmentation, firewall isolation, and VPN protections for control system devices. Prioritize validation of security updates before deployment.
CVSS
7
Vendor
Siemens
Published
Oct 23, 2026 · 06:10
Patch
Unknown / not confirmed
Affected products
PSS(R)SINCAL V21.5, PSS(R)SINCAL V22.0, PSS(R)SINCAL V22.5 (versions prior to V22.5.5)
Mitigation
Install WIBU Systems WibuKey Runtime for Windows version 6.72 or later. PSS(R)SINCAL V22.5 users should update to V22.5 Update 5 or later. Apply network segmentation, firewall isolation, and VPN protections for control system devices. Prioritize validation of security updates before deployment.
Siemens PSS(R)SINCAL software versions are affected by an out-of-bounds write vulnerability in the integrated WibuKey third-party driver (CVE-2026-84854). The flaw stems from insufficient input validation when calculating kernel buffer size, potentially causing system crashes and adjacent kernel memory modification. The vulnerability only affects PSS SINCAL when configured to use the legacy WibuKey dongle license type. Siemens and CISA advise applying mitigations while updates are prepared.