Is CVE-2025-40795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-40795 being exploited in the wild.

How severe is CVE-2025-40795?

Critical severity, with a CVSS score of 9.8, published 9 September 2025.

Which products and versions are affected?

Siemens Simatic Pcs Neo V4.1 (All versions), V5.0 (All versions), V6.0 < V6.0 SP1 Update 1; Siemens User Management Component All versions < V2.15.1.3.

Is there a fix for CVE-2025-40795?

A patch was published on 2026-06-09: Fix released for SIMATIC PCS neo V6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-40795 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-40795?

Check whether you run Siemens Simatic Pcs Neo or Siemens User Management Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-40795: Siemens SIMATIC PCS neo stack overflow in User Management Component

Q: Is there a fix for CVE-2025-40795?

A patch was published on 2026-06-09: Fix released for SIMATIC PCS neo V6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-40795 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-40795?

Check whether you run Siemens Simatic Pcs Neo or Siemens User Management Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-40795 · Severity: critical · CVSS 9.8 · Published 2025-09-09

Siemens SIMATIC PCS neo is a control system used to manage industrial plants and infrastructure. A critical security flaw in its user management component could allow an unauthorized person to remotely take control of the system or shut it down entirely. This could lead to significant operational disruptions, loss of control over industrial processes, or unauthorized access to sensitive plant data.

Technologies: Siemens Simatic Pcs Neo, Siemens User Management Component. Vendors: Siemens.

Quick answers

Is CVE-2025-40795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-40795 being exploited in the wild.
How severe is CVE-2025-40795?: Critical severity, with a CVSS score of 9.8, published 9 September 2025.
Which products and versions are affected?: Siemens Simatic Pcs Neo V4.1 (All versions), V5.0 (All versions), V6.0 < V6.0 SP1 Update 1; Siemens User Management Component All versions < V2.15.1.3.
Is there a fix for CVE-2025-40795?: A patch was published on 2026-06-09: Fix released for SIMATIC PCS neo V6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-40795 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-40795?: Check whether you run Siemens Simatic Pcs Neo or Siemens User Management Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the Siemens User Management Component (UMC) integrated into SIMATIC PCS neo. The vulnerability can be triggered by an unauthenticated remote attacker over the network without any user interaction. Successful exploitation could lead to arbitrary code execution with high privileges or a complete denial of service of the management component. Siemens has released updates for UMC (V2.15.1.3) and PCS neo V6.0 (SP1 Update 1), though no fixes are currently planned for PCS neo V4.1 and V5.0. Mitigations include blocking TCP ports 4002 and 4004.

Affected products

Siemens SIMATIC PCS neo V4.1 (All versions), V5.0 (All versions), V6.0 < V6.0 SP1 Update 1
Siemens User Management Component (UMC) All versions < V2.15.1.3

Timeline

2025-09-09: disclosed
2025-09-09: advisory
2026-06-09: patched: Fix released for SIMATIC PCS neo V6.0

References

https://cert-portal.siemens.com/productcert/html/ssa-722410.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.