Vulnerabilities
Siemens Teamcenter XSS Vulnerability (CVE‑2026‑58113) Could Let Attackers Hijack Authenticated Sessions
A reflected cross‑site scripting flaw in Siemens Teamcenter’s authentication redirect flow allows an unauthenticated attacker to inject JavaScript into an authenticated user’s browser by crafting a malicious URL. Successful exploitation can let the attacker read data or perform actions within the victim’s Teamcenter session. Siemens has issued patches for all affected releases; administrators should update immediately.
Siemens has disclosed a medium‑severity XSS flaw (CVE‑2026‑58113) that can be triggered through the /auth/ endpoint of Teamcenter. The vulnerability stems from improper encoding of user‑supplied input that is reflected into an HTML attribute during the authentication redirect flow.
How the Exploit Works
An attacker can craft a malicious URL that, when opened by an authenticated user, injects arbitrary JavaScript into the user’s browser. The injected script runs with the privileges of the logged‑in user, enabling the attacker to read sensitive data, manipulate the session, or perform unauthorized actions within Teamcenter.
Affected Versions
- Teamcenter V2412 < 2412.0013
- Teamcenter V2506 < 2506.0010
- Teamcenter V2512 < 2512.2607
- Teamcenter V2606 < 2606.2607
Impact
While the vulnerability requires an unauthenticated attacker to craft a URL, the damage is only realized when an authenticated user visits that URL. Potential impacts include data exfiltration, session hijacking, and unauthorized configuration changes within the Teamcenter environment.
Mitigation
Siemens has released updated builds for all affected releases. Administrators should immediately upgrade to:
- V2412.0013 or newer
- V2506.0010 or newer
- V2512.2607 or newer
- V2606.2607 or newer
In the interim, consider blocking external access to the /auth/ endpoint or restricting URL-based redirects until patches are applied.
Related vulnerabilities
Cisco ISE Web Interface Vulnerability Allows Remote XSS Attack (CVE‑2026‑20309)
A newly disclosed flaw in Cisco Identity Services Engine’s web‑based management console lets attackers inject malicious scripts into a victim’s browser. The vulnerability stems from inadequate input validation, enabling reflected XSS that can run arbitrary code or steal browser data. Cisco has released patches; no workarounds exist.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
Cisco IMC Web Interface XSS Exploit Enables Remote Script Execution – CVE‑2026‑20198
A newly disclosed cross‑site scripting flaw in Cisco’s Integrated Management Controller (IMC) web UI allows an authenticated, remote attacker to inject malicious code into a victim’s browser. By luring a logged‑in user to click a crafted link, the attacker can execute arbitrary scripts or steal browser‑based data. Cisco has released patches; no work‑arounds are available. The vulnerability carries a Medium impact rating and is tracked as CVE‑2026‑20198.
Read briefing