Siemens PSS(R)SINCAL: 1 CVE, High 7.0
Summary
CISA reports 1 vulnerability in Siemens PSS(R)SINCAL V21.5, PSS(R)SINCAL V22.0, PSS(R)SINCAL V22.5. Weakness type: Out-of-bounds Write. PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. Highest CVSS v3 score: 7.0 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Siemens
- Products
- PSS(R)SINCAL V21.5, PSS(R)SINCAL V22.0, PSS(R)SINCAL V22.5
- CVEs
- CVE-2026-84854
- Highest CVSS v3
- 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-84854 | Out-of-bounds Write | 7.0 | – | No | CVE-2026-84854 |
Affected products (3)
- PSS(R)SINCAL V21.5
- PSS(R)SINCAL V22.0
- PSS(R)SINCAL V22.5 < V22.5 Update 5
Vendor fixes and mitigations (from advisory)
- Mitigation: Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.
- None Available: Currently no fix is available
- Vendor Fix: Update to V22.5 Update 5 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-295-06
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-148322.json
- https://cert-portal.siemens.com/productcert/html/ssa-148322.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.