Siemens Capital Embedded AR Classic Out-of-Bounds Read Vulnerability Affects Critical Infrastructure Worldwide

Siemens ProductCERT has identified an out-of-bounds read vulnerability in Capital Embedded AR Classic software, tracked as CVE-2026-89208. The vulnerability affects two product lines: Capital Embedded AR Classic 431-422 (all versions) and Capital Embedded AR Classic R20-11 versions prior to V2303.

The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries, potentially leading to abnormal product behavior, instability, or denial of service.

The vulnerability has a CVSS 3.1 base score of 5.3, classified as MEDIUM severity, with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected sectors include Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The equipment is embedded in Electronic Control Units (ECUs) deployed worldwide.

Siemens has stated that no fix is currently planned for Capital Embedded AR Classic 431-422. For Capital Embedded AR Classic R20-11, the vendor recommends updating to version V2303 or later. In the interim, Siemens and CISA recommend applying network segmentation and placing ECUs behind properly configured gateways or firewalls to limit remote access.

CISA has published the advisory as ICSA-26-295-04 and recommends that organizations minimize network exposure for control system devices, ensure they are not accessible from the internet, and use secure methods such as VPNs when remote access is required. No public exploit code or confirmed wild exploitation has been reported as of the advisory release.