Siemens Siveillance Control: 1 CVE, Critical 9.0
Summary
CISA reports 1 vulnerability in Siemens Siveillance Control Pro V3.0, Siveillance Control Pro V4.0, Siveillance Control V3.0, Siveillance Control V4.0. Weakness type: Unrestricted Upload of File with Dangerous Type. A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . Highest CVSS v3 score: 9.0 (Critical), exploitable from an adjacent network.
At a glance
- Vendor
- Siemens
- Products
- Siveillance Control Pro V3.0, Siveillance Control Pro V4.0, Siveillance Control V3.0, Siveillance Control V4.0
- CVEs
- CVE-2026-50093
- Highest CVSS v3
- 9.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Communications, Commercial Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-50093 | Unrestricted Upload of File with Dangerous Type | 9.0 | – | No | CVE-2026-50093 |
Affected products (4)
- Siveillance Control Pro V3.0 < V3.0.12.2173
- Siveillance Control Pro V4.0 < V4.0.9.2178
- Siveillance Control V3.0 < V3.0.22.2177
- Siveillance Control V4.0 < V4.0.11.2177
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V3.0.12.2173 or later version link
- Vendor Fix: Update to V3.0.22.2177 or later version link
- Vendor Fix: Update to V4.0.11.2177 or later version link
- Vendor Fix: Update to V4.0.9.2178 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-265-03
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-254516.json
- https://cert-portal.siemens.com/productcert/html/ssa-254516.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.