CVE-2026-58114: Siemens SIMATIC NTLM authentication relay vulnerability

CVE-2026-58114 · Severity: high · CVSS 7.5 · Published 2026-11-10

Multiple Siemens industrial control products including SIMATIC WinCC (a SCADA system for plant monitoring), SIMATIC PCS 7 (a distributed control system), and related data storage and reporting components rely on the deprecated NTLM authentication protocol. An attacker positioned between a client and server can intercept NTLM authentication traffic and relay it to impersonate legitimate users, potentially gaining unauthorized access to critical production systems, databases, and operational data.

Technologies: Siemens SIMATIC WinCC. Vendors: Siemens.

Quick answers

Is CVE-2026-58114 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58114 being exploited in the wild.
How severe is CVE-2026-58114?
High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?
Siemens SIMATIC BATCH V9.1 all versions; Siemens SIMATIC Information Server 2022 all versions; Siemens SIMATIC PCS 7 V9.1 all versions; Siemens SIMATIC Process Historian 2022 all versions; and 2 more.
Is there a fix for CVE-2026-58114?
No fixed version is recorded yet. Enable encryption for SQL Server Database communication. Implement network segmentation to restrict remote access and deploy strong network access controls to limit exposure to attackers who can position themselves on the network path. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58114 attacked?
It is attacked over the network or from the adjacent network, in a network appliance.
Am I affected by CVE-2026-58114?
Check whether you run Siemens SIMATIC BATCH, Siemens SIMATIC Information Server, Siemens SIMATIC PCS 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Enable encryption for SQL Server Database communication. Implement network segmentation to restrict remote access and deploy strong network access controls to limit exposure to attackers who can position themselves on the network path.

Technical details

NTLM relay attack in remote authentication: an on-path attacker can intercept NTLM handshakes and relay them to connected services (such as SQL databases) without accessing the original user's credentials, achieving session hijacking and user impersonation. The vulnerability affects multiple Siemens SCADA and PCS 7 components across all listed versions; exploitation requires network positioning between client and server and user interaction (UI:R). Attack grants privileges of the impersonated user, potentially including control of production systems and sensitive data access.

Affected products

  • Siemens SIMATIC BATCH V9.1 all versions
  • Siemens SIMATIC Information Server 2020 all versions
  • Siemens SIMATIC Information Server 2022 all versions
  • Siemens SIMATIC PCS 7 V9.1 all versions
  • Siemens SIMATIC Process Historian 2020 all versions
  • Siemens SIMATIC Process Historian 2022 all versions
  • Siemens SIMATIC WinCC V7.5 all versions
  • Siemens SIMATIC WinCC V8.0 all versions
  • Siemens SIMATIC WinCC V8.1 all versions
  • Siemens SIMATIC WinCC Runtime Professional V17 all versions
  • Siemens SIMATIC WinCC Runtime Professional V18 all versions
  • Siemens SIMATIC WinCC Runtime Professional V19 all versions
  • Siemens SIMATIC WinCC Runtime Professional V20 all versions
  • Siemens SIMATIC WinCC Runtime Professional V21 all versions

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.