Vulnerabilities
Siemens SIPLUS and SIMATIC Products – Copy Fail Vulnerability (CVE-2026-31431)
Siemens has identified a Copy Fail vulnerability affecting multiple SIPLUS and SIMATIC products. The flaw, CVE‑2026‑31431, allows attackers to read or modify files on affected systems. Defenders should upgrade to the latest firmware or apply Siemens‑issued countermeasures.
Siemens has released a security advisory for the Copy Fail vulnerability (CVE‑2026‑31431) that affects a range of SIPLUS and SIMATIC products.
What happened
The flaw allows an attacker with local or remote access to read or modify files on the affected device, potentially enabling privilege escalation or disruption of industrial processes.
Affected Products
- SIMATIC AX Runtime Core Linux Common Debian – all versions
- SIMATIC AX Runtime Core Linux Common Debian arm64 – all versions
- SIMATIC AX Runtime Core Linux Platform Container Common Debian Development – all versions
- SIMATIC AX Runtime Core Linux VMWare Development – all versions
- SIMATIC CN 4100 – versions < 6.0
- SIMATIC HMI MTP1000 Unified Basic – versions < 21.0.2.1
- SIMATIC HMI MTP1000 Unified Comfort Panel (various models) – versions < 21.0.2.1
- SIMATIC HMI MTP1200 Comfort Pro (various configurations) – versions < 21.0.2.1
Impact
Unauthorized file access can lead to configuration tampering, unauthorized data exfiltration, or denial of service in control‑system environments.
Mitigation and Response
Siemens recommends:
- Upgrade to the latest firmware or software release for each affected product.
- For products without an available fix, apply the countermeasures outlined in the Siemens advisory, such as restricting local access and disabling unnecessary services.
- Verify the integrity of system files and monitor for anomalous file‑system activity.
Related vulnerabilities
Linux Kernel 'Copy Fail' (CVE‑2026‑31431) Hits All Mainstream Distros – Immediate Action Needed
A high‑local privilege escalation flaw dubbed "Copy Fail" (CVE‑2026‑31431) now affects every mainstream Linux distribution using a kernel built since 2017. A public proof‑of‑concept exists, but no vendor patches have been released yet. The mainline kernel fix landed on April 1, 2026, yet distribution updates lag behind. CERT‑EU urges users to deploy the interim mitigation right away, especially on Kubernetes nodes and CI/CD runners exposed to untrusted workloads.
Read briefing
ABB Ability Edgenius Hit by CVE‑2026‑31431: Linux Kernel Privilege Escalation
ABB’s industrial gateway platform, Ability Edgenius, is vulnerable to the CVE‑2026‑31431 “Copy Fail” Linux kernel flaw, allowing local or container‑based attackers to gain root privileges. Versions 3.2.0.0‑3.2.4.0 are affected and are fixed in 3.2.4.1. The flaw originates in the kernel’s cryptographic subsystem and poses a serious risk to critical manufacturing, energy, water, and chemical facilities worldwide. Operators should apply the patch ASAP and limit SSH/cockpit access to reduce exposure.
Read briefing
Siemens Teamcenter XSS Vulnerability (CVE‑2026‑58113) Could Let Attackers Hijack Authenticated Sessions
A reflected cross‑site scripting flaw in Siemens Teamcenter’s authentication redirect flow allows an unauthenticated attacker to inject JavaScript into an authenticated user’s browser by crafting a malicious URL. Successful exploitation can let the attacker read data or perform actions within the victim’s Teamcenter session. Siemens has issued patches for all affected releases; administrators should update immediately.
Read briefing
Microsoft Office for Mac Remote Code Execution Vulnerability (CVE‑2026‑88150) – Update Required
A remote code execution flaw exists in Microsoft Office Word for macOS, identified as CVE‑2026‑88150. Affected users must install the latest Office for Mac patch to prevent exploitation. Other Office products are not impacted.
Read briefing