Siemens Industrial Edge App Publisher Vulnerabilities Enable Network-Based RCE

Siemens Industrial Edge App Publisher is affected by two vulnerabilities that can be combined to allow an attacker on the network to execute arbitrary code on the local machine. CVE-2026-78556 stems from improper certificate validation when initiating a TLS connection, which allows an attacker to intercept and relay communication (man-in-the-middle attack) and spoof a trusted entity. CVE-2026-78557 involves the application's failure to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this XSS vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution on the victim's machine.

The two vulnerabilities can be chained: an attacker on the network can perform a man-in-the-middle attack via the certificate validation flaw, and then inject malicious, unsanitized data into the backend response. When the front-end renders this data, the XSS payload executes within the Node.js environment, leading to remote code execution.

Siemens has released an update for the Industrial Edge App Publisher and recommends updating to version 1.27.9 or later to remediate the issues. CISA recommends minimizing network exposure for control system devices, ensuring they are not accessible from the internet, and locating control system networks and remote devices behind firewalls and isolated from business networks. When remote access is required, CISA advises using Virtual Private Networks (VPNs) updated to the most current version available.