Is CVE-2026-102074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102074 being exploited in the wild.

How severe is CVE-2026-102074?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Siemens APOGEE MBC (PPC) (BACnet) All versions; Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions; Siemens APOGEE MEC (PPC) (BACnet) All versions; Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions; and 6 more.

Is there a fix for CVE-2026-102074?

Yes: fixed in APOGEE PXC Compact (BACnet) V3.5.7 or later; APOGEE PXC Compact (P2 Ethernet) V2.8.21 or later; APOGEE PXC Modular (BACnet) V3.5.7 or later; APOGEE PXC Modular (P2 Ethernet) V2.8.21 or later; TALON TC Compact (BACnet) V3.5.7 or later; TALON TC Modular (BACnet) V3.5.7 or later. Until then: Disable the FTP/Web service if not required for maintenance; note that this service is disabled by default on APOGEE and TALON products. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102074 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-102074?

Check whether you run Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102074: Siemens APOGEE/TALON FTP input validation denial of service

CVE-2026-102074 · Severity: high · CVSS 7.5 · Published 2026-10-13

Building automation controllers from Siemens (APOGEE and TALON products) contain an FTP service that does not properly validate user input length, allowing an unauthenticated remote attacker to crash the device. This could disrupt critical HVAC, lighting, or other facility management systems that these controllers operate. The FTP service is disabled by default but can be enabled for maintenance purposes.

Technologies: Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet), Siemens APOGEE MEC (PPC) (P2 Ethernet), Siemens APOGEE PXC Compact (BACnet), Siemens APOGEE PXC Compact (P2 Ethernet), Siemens APOGEE PXC Modular (BACnet), Siemens APOGEE PXC Modular (P2 Ethernet), Siemens TALON TC Compact (BACnet), Siemens TALON TC Modular (BACnet). Vendors: Siemens.

Quick answers

Is CVE-2026-102074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102074 being exploited in the wild.
How severe is CVE-2026-102074?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Siemens APOGEE MBC (PPC) (BACnet) All versions; Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions; Siemens APOGEE MEC (PPC) (BACnet) All versions; Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions; and 6 more.
Is there a fix for CVE-2026-102074?: Yes: fixed in APOGEE PXC Compact (BACnet) V3.5.7 or later; APOGEE PXC Compact (P2 Ethernet) V2.8.21 or later; APOGEE PXC Modular (BACnet) V3.5.7 or later; APOGEE PXC Modular (P2 Ethernet) V2.8.21 or later; TALON TC Compact (BACnet) V3.5.7 or later; TALON TC Modular (BACnet) V3.5.7 or later. Until then: Disable the FTP/Web service if not required for maintenance; note that this service is disabled by default on APOGEE and TALON products. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102074 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-102074?: Check whether you run Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: APOGEE PXC Compact (BACnet) V3.5.7 or later; APOGEE PXC Compact (P2 Ethernet) V2.8.21 or later; APOGEE PXC Modular (BACnet) V3.5.7 or later; APOGEE PXC Modular (P2 Ethernet) V2.8.21 or later; TALON TC Compact (BACnet) V3.5.7 or later; TALON TC Modular (BACnet) V3.5.7 or later

Disable the FTP/Web service if not required for maintenance; note that this service is disabled by default on APOGEE and TALON products.

Technical details

The FTP service in affected Siemens controllers fails to validate the length of user-supplied input, enabling a denial-of-service attack through oversized input that crashes the service or device. An unauthenticated attacker on the network can trigger this condition remotely without authentication. The vulnerability affects multiple product lines; fixes are available for some (PXC/TALON devices) but not yet for APOGEE MBC/MEC.

Affected products

Siemens APOGEE MBC (PPC) (BACnet) All versions
Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions
Siemens APOGEE MEC (PPC) (BACnet) All versions
Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions
Siemens APOGEE PXC Compact (BACnet) All versions < V3.5.7
Siemens APOGEE PXC Compact (P2 Ethernet) All versions < V2.8.21
Siemens APOGEE PXC Modular (BACnet) All versions < V3.5.7
Siemens APOGEE PXC Modular (P2 Ethernet) All versions < V2.8.21
Siemens TALON TC Compact (BACnet) All versions < V3.5.7
Siemens TALON TC Modular (BACnet) All versions < V3.5.7

Timeline

2026-10-13: disclosed

References

https://cert-portal.siemens.com/productcert/html/ssa-333035.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.