Siemens SIMATIC WinCC Database Privilege Escalation Vulnerability (CVE-2026-59241)

Siemens ProductCERT has disclosed a critical vulnerability in SIMATIC WinCC, a widely used human-machine interface (HMI) and supervisory control and data acquisition (SCADA) platform. The vulnerability, tracked as CVE-2026-59241, carries a CVSS v3.1 base score of 8.8 and is classified as HIGH severity.

The issue arises from incorrect privilege assignment within the application's database component. Because the software does not sufficiently restrict permissions assigned to a database role, an authenticated remote attacker who already has access to the database could escalate their privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed.

The affected product lines are:
- SIMATIC WinCC V7.5: All versions are affected.
- SIMATIC WinCC V8.0: Versions prior to 8.0.0.11 (before Update 11).
- SIMATIC WinCC V8.1: Versions prior to 8.1.7.

Siemens reports that the vulnerability impacts critical infrastructure sectors worldwide, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities.

Mitigation status varies by version. Siemens has released vendor fixes for WinCC V8.0 (Update 11 or later) and WinCC V8.1 (Update 7 or later). For SIMATIC WinCC V7.5, no fix is currently available; Siemens recommends protective network measures as mitigation.

CISA has published the advisory (ICSA-26-295-13) and recommends that organizations minimize network exposure for control system devices, ensure they are not accessible from the internet, and locate control system networks behind firewalls, isolating them from business networks. When remote access is required, the use of VPNs is advised, with the caveat that VPN security depends on connected devices.