CVE-2026-58114: High severity Siemens SIMATIC BATCH vulnerability

Published Nov 10, 2026

Updated

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

Affected Software

6 affected components

Siemens SIMATIC BATCH=9.1

Siemens Simatic Information Server=2020, =2022

Siemens SIMATIC PCS 7=9.1

Siemens Simatic Process Historian=2020, =2022

Siemens SIMATIC WinCC Runtime Professional=17, =18, =19, =20, =21

Siemens SIMATIC WinCC=7.5, =8.0, =8.1

Event History

Nov 10, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker must be in a machine-in-the-middle position and able to relay NTLM authentication traffic. No prior authentication is required, but exploitation requires user interaction and has high attack complexity.

Which systems should be considered affected?

All versions of the listed SIMATIC BATCH V9.1, SIMATIC Information Server 2020 and 2022, SIMATIC PCS 7 V9.1, SIMATIC Process Historian 2020 and 2022, SIMATIC WinCC Runtime Professional V17 through V21, and SIMATIC WinCC V7.5, V8.0, and V8.1 are affected.

What could an attacker gain through successful exploitation?

An attacker could impersonate a legitimate user by relaying NTLM authentication. The resulting impact depends on services accessible to that user, such as a SQL Server used by WinCC, and may affect confidentiality, integrity, and availability.