Patch days / January 2026

Siemens ProductCERT Patch Day — January 2026

Tuesday, 13 January 2026

Vulnerabilities: 3
Critical: 1
High: 2
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 10.0
CVE-2025-40805 Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent …

All vulnerabilities 3

Critical1 Show

Critical 10.0
CVE-2025-40805 Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent …

High2 Show