1. Executive summary
Siemens ProductCERT advisory SSA-328642, republished by CISA as ICSA-26-265-04, discloses the "Copy Fail" vulnerability (CVE-2026-31431) across a broad range of SIPLUS and SIMATIC products, including AX Runtime Core Linux builds, the CN 4100 communications processor, and the MTP-series Unified and Comfort Pro HMI panels. The flaw is a Linux kernel issue in the algif_aead cryptographic interface, classified as CWE-669 Incorrect Resource Transfer Between Spheres, with CVSS 3.1 base score 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation is local: a user with a shell on the affected device's GNU/Linux subsystem, or code already running in a compromised container workload, can escalate to root and take full control of the node. No CISA-KEV listing applies to this CVE in the verified reference data, and none was resolved for this item. For EMEA financial services the exposure sits in OT estates, building management systems, branch facilities and data-centre infrastructure rather than core banking platforms, but a rooted edge or HMI node is a foothold from which an attacker can reach production networks.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | The vulnerable components are Siemens-supplied OT hardware and firmware embedded in the ICT estate, and for a subset of products Siemens states no fix is currently available, leaving a known high-severity flaw in a third-party product with only compensating controls. | Fold affected Siemens product versions into third-party ICT risk assessments; record the unpatchable subset explicitly and track Siemens' pending fix versions as a supplier commitment. |
| DORA Art. 24: digital operational resilience testing — general requirements | The primary exploitation path is local privilege escalation on devices whose interactive Linux shell Siemens says should be limited to trusted personnel, which is testable. | Include shell-access and local-privilege-escalation checks against affected SIMATIC devices in the resilience testing programme. |
No specific NIS2 article is directly engaged by this item. The NIS2 Art. 21(2)(d) supply chain security measures scope is not triggered by a vendor advisory alone on these facts, and no incident or reportable event is described.
3. Technical analysis & attack chain
The vulnerability is CVE-2026-31431, "Copy Fail", a flaw in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect in-place operation was introduced in which the source and destination data came from different mappings. The kernel fix reverts commit 72548b093ee3, restoring out-of-place operation and copying the associated data directly, because there is no benefit to in-place operation in algif_aead when source and destination mappings differ. The upstream description frames the consequence as unexpected behaviour or data integrity issues during cryptographic operations; the ABB advisory for the same CVE, which shares the identical CWE-669 classification and CVSS 3.1 score of 7.8 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, states the practical impact more directly: a locally authenticated user or compromised container workload can gain elevated root privileges on the affected system, and once root is obtained the attacker has complete control of the node. ABB also notes the flaw impacts kernels used by most major Linux distributions released since 2017, which explains the breadth of the Siemens product list.
Confirmed attack chain, as far as the sources support it:
- The attacker obtains local code execution on an affected device's GNU/Linux subsystem, either as an authenticated user with shell access or as a process inside a compromised container workload. The vector for this initial access is not described in the source material and is out of scope of the advisory.
- The attacker's code exercises the algif_aead interface in the vulnerable kernel, exploiting the incorrect in-place operation between differing source and destination mappings.
- Privilege escalation to root follows on successful exploitation.
- With root, the attacker has complete control of the node: arbitrary code execution, and per the ABB writeup, the ability to render the node unavailable.
The attack chain ends at the compromised node. The sources describe no persistence mechanism, command-and-control, lateral movement or data exfiltration specific to this CVE, and we do not speculate on them.
Affected products, per the CISA republication, all map to CVE-2026-31431: SIMATIC AX Runtime Core Linux Common Debian (all versions), AX Runtime Core Linux Common Debian arm64 (all versions), AX Runtime Core Linux Platform Container Common Debian Development (all versions), AX Runtime Core Linux VMWare Development (all versions), SIMATIC CN 4100 below V6.0, and the SIMATIC HMI MTP1000, MTP1200, MTP1500 and MTP1900 families in Unified Basic, Unified Comfort Panel and Comfort Pro variants below version 21.0.2.1, identified by their full order numbers (for example 6AV2123-3KB32-0AW0, 6AV2128-3KB06-0AX1, 6AV2128-3MB27-0BX0). The SIPLUS variants of these products are covered by the same advisory. The fix for the HMI and AX Runtime products is V21 Update 2 SR1 or later; the CN 4100 fix is V6.0 or later. One product entry in the advisory lists "Update to V21 SP2 Update 1 or later version" with a missing download link, an editorial defect in the source we flag rather than resolve.
Two caveats on sourcing. First, the root-privilege-escalation impact statement comes from the ABB advisory for the same CVE, not from the Siemens text, which restricts itself to the kernel commit description and the CWE/CVSS classification; the impact assessment is consistent across both vendors but the Siemens advisory itself does not spell out the escalation path. Second, the CISA page is a verbatim republication of the Siemens CSAF advisory and CISA disclaims editorial and technical accuracy for it; the authoritative fix references are the Siemens support portal links, 109825605, 109825897 and 109814144.
4. Mitigation & containment
P1, within 24 hours
- Inventory the OT and facilities estate for the affected order numbers and product families listed in §3, including SIPLUS variants, and record which fall below V21.0.2.1 (HMI and AX Runtime) or V6.0 (CN 4100). The AX Runtime Core Linux entries are version "all", so treat every deployment as affected.
- Restrict interactive shell access to the additional GNU/Linux subsystem of affected devices to trusted personnel only, per the Siemens countermeasure. Where the subsystem is not needed operationally, disable it.
- Block or tightly allow-list inbound access to management interfaces (SSH, cockpit and equivalents) on affected devices at the segment firewall. Do not expose these interfaces beyond the OT management zone.
P2, within 72 hours
- Update affected HMI panels and AX Runtime products to V21 Update 2 SR1 or later, using the Siemens support entries 109825605 and 109825897. Update the SIMATIC CN 4100 to V6.0 or later, per support entry 109814144. Schedule updates against the change-control calendar for production OT; where a window is not available inside 72 hours, document the compensating controls and the planned date.
- For products where the advisory states no fix is currently available, apply the vendor countermeasures and record the device on an exception register with a review date tied to Siemens' pending fix releases.
- Only build and run applications from trusted sources on the devices' Linux subsystems, per the Siemens recommendation. Verify any third-party or in-house code already deployed on these subsystems.
P3, within 7 days
- Configure the environment per Siemens' operational guidelines for Industrial Security (https://www.siemens.com/cert/operational-guidelines-industrial-security), in particular network segmentation between OT zones and enterprise IT.
- Review whether other Linux-based edge or control devices in the estate, from any vendor, run kernels released since 2017 and are therefore potentially exposed to the same CVE, given ABB's statement on distribution coverage. The ABB Ability Edgenius fix (3.2.4.1) is one confirmed instance; check other edge platforms with the same question.
- Confirm patch status in the asset register and close out the exception entries for updated devices.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources describe one observable behaviour relevant to detection: successful exploitation yields root privileges for a locally authenticated user or a container workload that did not previously hold them.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Non-root user or container process on an affected device's GNU/Linux subsystem acquiring root privileges or executing with uid 0 | Audit logs on the device's Linux subsystem; container runtime logs; EDR on OT management hosts | Moderate; impact is corroborated across the Siemens and ABB advisories for the same CVE, but no exploit artefact or sample is described |
6. Detection
Insufficient indicators to author detection rules.
The source material contains no exploit strings, file names, command lines, registry keys or network signatures for CVE-2026-31431. The kernel commit hash 72548b093ee3 references the fixing commit, not a threat artefact, and a rule built on it would match patch reporting rather than exploitation. Monitor Siemens support entries 109825605, 109825897 and 109814144 for updated guidance, and watch for public exploit code appearing against this CVE.
7. Sources
- CISA, Siemens SIPLUS and SIMATIC Products (ICSA-26-265-04), https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-04, 2026-09-22 (republication of Siemens SSA-328642, first published 2026-09-08)
- Siemens ProductCERT, SSA-328642 fix references: https://support.industry.siemens.com/cs/ww/en/view/109825605/, https://support.industry.siemens.com/cs/ww/en/view/109825897/, https://support.industry.siemens.com/cs/ww/en/view/109814144/
- CISA, Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (ICSA-26-209-04), https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04, context on the additional GNU/Linux subsystem and shell-access countermeasure
- CISA, ABB Ability Edgenius (ICSA-26-260-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-06, 2026, impact analysis for CVE-2026-31431 and kernel coverage since 2017
8. Adverse Trace position
We assess this as a high-severity local privilege escalation with contained blast radius per device but a wide affected footprint across Siemens OT estates, and no evidence of in-the-wild exploitation in the material available to us; the CVSS 3.1 score of 7.8 (HIGH) and the absence of a CISA-KEV listing reflect that. The practical risk to EMEA financial services clients is concentrated in OT and facilities estates, HMI panels and edge compute nodes, where a rooted device is a staging point into segmented networks; clients with no Siemens SIMATIC or SIPLUS footprint in their OT estate have no direct exposure from this advisory but should still check other Linux-based edge platforms against the same CVE, since the underlying kernel flaw affects distributions released since 2017. The root-escalation impact statement is corroborated by two vendor advisories for the same CVE, but no exploit artefact exists in the public material we reviewed, so detection remains behavioural and enforcement should rest on patching and shell-access restriction rather than IOC sweeps. We will track Siemens' pending fix versions for the products where no fix is currently available, monitor for any CISA-KEV addition or public exploit code against CVE-2026-31431, and update this advisory if either appears.
Published via PulseTrace — Adverse Trace threat intelligence.