# CVE-2026-54799: Siemens CPCI85 and SICORE firmware signature validation bypass

Source: https://junglewise.ai/threats/cve-2026-54799-siemens-cpci85-and-sicore-firmware-signature-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-54799 · Severity: medium · CVSS 6.7 · Published 2026-07-09

Siemens CPCI85 and SICORE firmware, used in industrial automation and power grid control devices, contain a flaw in how they verify software updates. An attacker with high-level system access could bypass security checks to install unauthorized, malicious firmware. This could result in permanent control over the device, potentially disrupting critical infrastructure operations or compromising sensitive industrial data.

Technologies: [Siemens CPCI85 Central Processing/Communication](https://junglewise.ai/threats/technologies/cpci85-central-processing-communication), [Siemens SICORE Base system](https://junglewise.ai/threats/technologies/sicore-base-system). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-54799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54799 being exploited in the wild.

**How severe is CVE-2026-54799?** Medium severity, with a CVSS score of 6.7, published 9 July 2026.

**Which products and versions are affected?** Siemens CPCI85 Central Processing/Communication All versions < V26.20; Siemens SICORE Base system All versions < V26.20.0.

**Is there a fix for CVE-2026-54799?** A patch was published on 2026-07-09: Firmware versions V26.20 / V26.20.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54799 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-54799?** Check whether you run Siemens CPCI85 Central Processing/Communication or Siemens SICORE Base system at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the firmware update mechanism's signature validation process within Siemens CPCI85 (used in SICAM A8000 and EGS) and SICORE (used in SICAM A8000 and S8000). The root cause is related to improper validation of cryptographic signatures during the update process, categorized under CWE-489. An attacker with administrative or high-privileged local access (PR:H) can exploit this to bypass integrity checks and install modified firmware. Successful exploitation leads to persistent, unauthorized code execution with full system privileges. Siemens has released firmware version V26.20 (and V26.20.0 for SICORE) to remediate this issue.

## Affected products

- Siemens CPCI85 Central Processing/Communication All versions < V26.20
- Siemens SICORE Base system All versions < V26.20.0

## Timeline

- 2026-07-09: disclosed: Initial publication of SSA-229470 by Siemens ProductCERT
- 2026-07-09: patched: Firmware versions V26.20 / V26.20.0 released to address the vulnerability

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-229470.html](https://cert-portal.siemens.com/productcert/html/ssa-229470.html)

## Related threats

- [Siemens SICAM 8 privilege escalation in web API](https://junglewise.ai/threats/cve-2026-54801-siemens-sicam-8-privilege-escalation-in-web-api)
- [Siemens SICAM 8 insecure default configuration in OPC UA](https://junglewise.ai/threats/cve-2026-54800-siemens-sicam-8-insecure-default-configuration-in-opc-ua)
- [Siemens SICAM 8 active debug code in CPCI85 and SICORE firmware](https://junglewise.ai/threats/cve-2026-54798-siemens-sicam-8-active-debug-code-in-cpci85-and-sicore-firmware)