Siemens ProductCERT Patch Day — October 2026

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Medium 6.7
  CVE-2026-110936 Exploited Public exploit A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an …

Critical 4

• Critical 9.6
  CVE-2026-63350 Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized u…
• Critical 9.6
  CVE-2026-63353 Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacke…
• Critical 9.6
  CVE-2026-63354 Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This cou…
• Critical 9.1
  CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to acces…

All vulnerabilities 33