CVE-2026-58114
Received Received - Intake

NTLM Authentication Relay in SIMATIC Products

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: siemens-SADP

Description
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V17 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC Runtime Professional V20 (All versions), SIMATIC WinCC Runtime Professional V21 (All versions), SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All versions). Affected systems do not properly secure their remote user authentication with the deprecated NTLM protocol. This could allow unauthenticated remote attackers, who have achieved a machine in the middle position, to relay NTLM authentication and impersonate a legitimate user. The potential impact depends on the services that are accessible, e.g. a SQL server used by WinCC.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-58114
EUVD
EUVD-2026-120886

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1390 The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-58114 is an authentication bypass vulnerability in multiple Siemens SIMATIC SCADA and PCS 7 systems. Affected systems use the deprecated NTLM protocol for remote user authentication, which does not properly secure authentication. This allows an attacker in a machine-in-the-middle position to relay NTLM authentication and impersonate legitimate users, potentially gaining unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking for NTLM protocol usage in affected SIMATIC systems. Inspect network traffic for NTLM authentication attempts using tools like Wireshark or tcpdump. Check system logs for unusual authentication events or relayed NTLM handshakes. Verify if SQL Server Database encryption is properly configured as per Siemens' guidelines.

Impact Analysis

An attacker could exploit this to impersonate legitimate users and gain access to systems, potentially executing arbitrary code with the victim's privileges. The impact depends on accessible services, such as a SQL server used by WinCC. Unauthorized access could lead to data breaches, operational disruptions, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result from inadequate protection of personal or health data, potentially leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable NTLM protocol usage where possible and enforce Kerberos authentication. Configure SQL Server Database encryption for secure communication. Restrict network access to affected systems and follow Siemens' Industrial Security guidelines. Monitor for unauthorized authentication attempts and update systems once patches are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...