# CVE-2026-102076: Siemens APOGEE/TALON web service input validation denial of service

Source: https://junglewise.ai/threats/cve-2026-102076-a-vulnerability-has-been-identified-in-apogee-mbc-ppc-bacnet-all  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-102076 · Severity: high · CVSS 7.5 · Published 2026-10-13

Siemens APOGEE and TALON building automation controllers contain multiple vulnerabilities in their web service that fail to validate user input during code uploads. An unauthenticated attacker on the network can exploit this to cause a denial of service, disrupting heating, cooling, and other critical building control functions. While fixes are available for some product lines, others have no patch planned.

Technologies: [Siemens APOGEE MBC (PPC) (BACnet)](https://junglewise.ai/threats/technologies/apogee-mbc-ppc-bacnet), [Siemens APOGEE MBC (PPC) (P2 Ethernet)](https://junglewise.ai/threats/technologies/apogee-mbc-ppc-p2-ethernet), [Siemens APOGEE MEC (PPC) (BACnet)](https://junglewise.ai/threats/technologies/apogee-mec-ppc-bacnet), [Siemens APOGEE MEC (PPC) (P2 Ethernet)](https://junglewise.ai/threats/technologies/apogee-mec-ppc-p2-ethernet), [Siemens APOGEE PXC Compact (BACnet)](https://junglewise.ai/threats/technologies/apogee-pxc-compact-bacnet), [Siemens APOGEE PXC Compact (P2 Ethernet)](https://junglewise.ai/threats/technologies/apogee-pxc-compact-p2-ethernet), [Siemens APOGEE PXC Modular (BACnet)](https://junglewise.ai/threats/technologies/apogee-pxc-modular-bacnet), [Siemens APOGEE PXC Modular (P2 Ethernet)](https://junglewise.ai/threats/technologies/apogee-pxc-modular-p2-ethernet), [Siemens TALON TC Compact (BACnet)](https://junglewise.ai/threats/technologies/talon-tc-compact-bacnet), [Siemens TALON TC Modular (BACnet)](https://junglewise.ai/threats/technologies/talon-tc-modular-bacnet). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-102076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102076 being exploited in the wild.

**How severe is CVE-2026-102076?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** Siemens APOGEE MBC (PPC) (BACnet) All versions; Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions; Siemens APOGEE MEC (PPC) (BACnet) All versions; Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions; and 6 more.

**Is there a fix for CVE-2026-102076?** Yes: fixed in APOGEE PXC Compact (BACnet) V3.5.7, APOGEE PXC Compact (P2 Ethernet) V2.8.21, APOGEE PXC Modular (BACnet) V3.5.7, APOGEE PXC Modular (P2 Ethernet) V2.8.21, TALON TC Compact (BACnet) V3.5.7, TALON TC Modular (BACnet) V3.5.7. Until then: Disable the FTP/Web service; note that this service is disabled by default on APOGEE, Desigo, and TALON products but should be verified if it was explicitly enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102076 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-102076?** Check whether you run Siemens APOGEE MBC (PPC) (BACnet), Siemens APOGEE MBC (PPC) (P2 Ethernet), Siemens APOGEE MEC (PPC) (BACnet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in APOGEE PXC Compact (BACnet) V3.5.7, APOGEE PXC Compact (P2 Ethernet) V2.8.21, APOGEE PXC Modular (BACnet) V3.5.7, APOGEE PXC Modular (P2 Ethernet) V2.8.21, TALON TC Compact (BACnet) V3.5.7, TALON TC Modular (BACnet) V3.5.7

Disable the FTP/Web service; note that this service is disabled by default on APOGEE, Desigo, and TALON products but should be verified if it was explicitly enabled.

## Technical details

The web service in affected APOGEE MBC, APOGEE MEC, APOGEE PXC, and TALON TC controllers does not properly validate user-supplied input in code upload functionality, enabling an unauthenticated remote attacker to trigger a denial of service. The vulnerability requires network access to the web service but no authentication. Patches are available for PXC Compact and Modular variants (V3.5.7 / V2.8.21), but APOGEE MBC and MEC have no fix planned.

## Affected products

- Siemens APOGEE MBC (PPC) (BACnet) All versions
- Siemens APOGEE MBC (PPC) (P2 Ethernet) All versions
- Siemens APOGEE MEC (PPC) (BACnet) All versions
- Siemens APOGEE MEC (PPC) (P2 Ethernet) All versions
- Siemens APOGEE PXC Compact (BACnet) All versions < V3.5.7
- Siemens APOGEE PXC Compact (P2 Ethernet) All versions < V2.8.21
- Siemens APOGEE PXC Modular (BACnet) All versions < V3.5.7
- Siemens APOGEE PXC Modular (P2 Ethernet) All versions < V2.8.21
- Siemens TALON TC Compact (BACnet) All versions < V3.5.7
- Siemens TALON TC Modular (BACnet) All versions < V3.5.7

## Timeline

- 2026-10-13: disclosed

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-333035.html](https://cert-portal.siemens.com/productcert/html/ssa-333035.html)

## Related threats

- [Siemens APOGEE/TALON web service input validation DoS](https://junglewise.ai/threats/cve-2026-102075-a-vulnerability-has-been-identified-in-apogee-mbc-ppc-bacnet-all)
- [Siemens APOGEE/TALON FTP input validation denial of service](https://junglewise.ai/threats/cve-2026-102074-a-vulnerability-has-been-identified-in-apogee-mbc-ppc-bacnet-all)
- [Siemens APOGEE PXC/MBC/MEC input validation in web service](https://junglewise.ai/threats/cve-2026-102073-a-vulnerability-has-been-identified-in-apogee-mbc-ppc-bacnet-all)