CVE-2026-44415: Siemens Industrial Edge path traversal in internal APIs

CVE-2026-44415 · Severity: critical · CVSS 9.1 · Published 2026-10-13

Siemens Industrial Edge devices and related components fail to properly restrict access to internal APIs and system paths for authenticated users. An attacker with valid credentials can exploit this path traversal vulnerability to read sensitive internal information, potentially leading to further compromise of the system or unauthorized data deletion in critical industrial environments.

Vendors: Siemens.

Quick answers

Is CVE-2026-44415 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44415 being exploited in the wild.
How severe is CVE-2026-44415?
Critical severity, with a CVSS score of 9.1, published 13 October 2026.
Which products and versions are affected?
Siemens Industrial Edge Cloud Device (IECD) < V1.28.1; Siemens Industrial Edge Device Kit - arm64 V1.5 through V1.25; V1.26 < V1.26.2-1; V1.27 < V1.27.1-1; V1.28 < V1.28.0-6; Siemens Industrial Edge Device Kit - x86-64 V1.5 through V1.7; Siemens Industrial Edge Own Device (IEOD) < V1.28.1; and 6 more.
Is there a fix for CVE-2026-44415?
Yes: fixed in Industrial Edge Device Kit - arm64 V1.26.2-1, V1.27.1-1, V1.28.0-6; Industrial Edge Cloud Device (IECD) V1.28.1; Industrial Edge Own Device (IEOD) V1.28.1; Industrial Edge Virtual Device (IEVD) V1.28.1. Until then: Restrict network access to affected devices and their internal APIs using firewall rules and access control lists. Disable or isolate internal API paths that are not required for normal operation, and monitor authentication logs for suspicious access patterns from authenticated users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44415 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44415?
Check whether you run Siemens Industrial Edge Cloud Device (IECD), Siemens Industrial Edge Device Kit - arm64, Siemens Industrial Edge Device Kit - x86-64 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Industrial Edge Device Kit - arm64 V1.26.2-1, V1.27.1-1, V1.28.0-6; Industrial Edge Cloud Device (IECD) V1.28.1; Industrial Edge Own Device (IEOD) V1.28.1; Industrial Edge Virtual Device (IEVD) V1.28.1

Restrict network access to affected devices and their internal APIs using firewall rules and access control lists. Disable or isolate internal API paths that are not required for normal operation, and monitor authentication logs for suspicious access patterns from authenticated users.

Technical details

Path traversal vulnerability in Industrial Edge Device Kit and related devices allows authenticated remote attackers to access sensitive internal information through improperly restricted internal API paths. The vulnerability requires prior authentication and network access to the affected device. Exploitation enables information disclosure and may facilitate privilege escalation or data destruction.

Affected products

  • Siemens Industrial Edge Device Kit - arm64 V1.5 through V1.25; V1.26 < V1.26.2-1; V1.27 < V1.27.1-1; V1.28 < V1.28.0-6
  • Siemens Industrial Edge Device Kit - x86-64 V1.5 through V1.7
  • Siemens Industrial Edge Cloud Device (IECD) < V1.28.1
  • Siemens Industrial Edge Own Device (IEOD) < V1.28.1
  • Siemens Industrial Edge Virtual Device (IEVD) < V1.28.1
  • Siemens SCALANCE LPE9413 all versions
  • Siemens SCALANCE LPE9433 all versions
  • Siemens SIMATIC HMI MTP1200 Comfort Pro all versions
  • Siemens SIMATIC HMI MTP1500 Comfort Pro all versions
  • Siemens SIMATIC HMI MTP1900 Comfort Pro all versions

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.