Is CVE-2026-102075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102075 being exploited in the wild.

How severe is CVE-2026-102075?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Siemens APOGEE MBC (PPC) (BACnet) All versions; Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions; Siemens APOGEE MEC (PPC) (BACnet) All versions; Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions; and 6 more.

Is there a fix for CVE-2026-102075?

Yes: fixed in APOGEE PXC Compact (BACnet) V3.5.7 or later, APOGEE PXC Compact (P2 Ethernet) V2.8.21 or later, APOGEE PXC Modular (BACnet) V3.5.7 or later, APOGEE PXC Modular (P2 Ethernet) V2.8.21 or later, TALON TC Compact (BACnet) V3.5.7 or later, TALON TC Modular (BACnet) V3.5.7 or later. No fix planned for APOGEE MBC or APOGEE MEC variants.. Until then: Disable the FTP/Web service if not required for operations. Note that the web/FTP service is disabled by default on these products, so this mitigation applies only to deployments that have explicitly enabled it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102075 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-102075?

Check whether you run Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102075: Siemens APOGEE/TALON web service input validation DoS

CVE-2026-102075 · Severity: high · CVSS 7.5 · Published 2026-10-13

Siemens building automation controllers used in APOGEE and TALON product lines contain an input validation flaw in their web service that could allow remote attackers to crash the device and disrupt facility operations. An unauthenticated attacker on the network can send malformed multipart requests to trigger a denial of service, potentially affecting climate control, security, or other critical building systems.

Technologies: Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet), Siemens APOGEE MEC (PPC) (P2 Ethernet), Siemens APOGEE PXC Compact (BACnet), Siemens APOGEE PXC Compact (P2 Ethernet), Siemens APOGEE PXC Modular (BACnet), Siemens APOGEE PXC Modular (P2 Ethernet), Siemens TALON TC Compact (BACnet), Siemens TALON TC Modular (BACnet). Vendors: Siemens.

Quick answers

Is CVE-2026-102075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102075 being exploited in the wild.
How severe is CVE-2026-102075?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Siemens APOGEE MBC (PPC) (BACnet) All versions; Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions; Siemens APOGEE MEC (PPC) (BACnet) All versions; Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions; and 6 more.
Is there a fix for CVE-2026-102075?: Yes: fixed in APOGEE PXC Compact (BACnet) V3.5.7 or later, APOGEE PXC Compact (P2 Ethernet) V2.8.21 or later, APOGEE PXC Modular (BACnet) V3.5.7 or later, APOGEE PXC Modular (P2 Ethernet) V2.8.21 or later, TALON TC Compact (BACnet) V3.5.7 or later, TALON TC Modular (BACnet) V3.5.7 or later. No fix planned for APOGEE MBC or APOGEE MEC variants.. Until then: Disable the FTP/Web service if not required for operations. Note that the web/FTP service is disabled by default on these products, so this mitigation applies only to deployments that have explicitly enabled it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102075 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-102075?: Check whether you run Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: APOGEE PXC Compact (BACnet) V3.5.7 or later, APOGEE PXC Compact (P2 Ethernet) V2.8.21 or later, APOGEE PXC Modular (BACnet) V3.5.7 or later, APOGEE PXC Modular (P2 Ethernet) V2.8.21 or later, TALON TC Compact (BACnet) V3.5.7 or later, TALON TC Modular (BACnet) V3.5.7 or later. No fix planned for APOGEE MBC or APOGEE MEC variants.

Disable the FTP/Web service if not required for operations. Note that the web/FTP service is disabled by default on these products, so this mitigation applies only to deployments that have explicitly enabled it.

Technical details

The web service in affected APOGEE MBC, MEC, PXC and TALON TC controllers fails to properly validate user input in multipart form data handling, allowing unauthenticated remote denial of service. Attack vector is network-based with no authentication required. The web/FTP service is disabled by default but can be enabled, making this a concern for deployments that activate these features.

Affected products

Siemens APOGEE MBC (PPC) (BACnet) All versions
Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions
Siemens APOGEE MEC (PPC) (BACnet) All versions
Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions
Siemens APOGEE PXC Compact (BACnet) All versions < V3.5.7
Siemens APOGEE PXC Compact (P2 Ethernet) All versions < V2.8.21
Siemens APOGEE PXC Modular (BACnet) All versions < V3.5.7
Siemens APOGEE PXC Modular (P2 Ethernet) All versions < V2.8.21
Siemens TALON TC Compact (BACnet) All versions < V3.5.7
Siemens TALON TC Modular (BACnet) All versions < V3.5.7

Timeline

2026-10-13: disclosed

References

https://cert-portal.siemens.com/productcert/html/ssa-333035.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.