Siemens Teamcenter

1. Executive summary

Siemens has published a fix for a reflected cross-site scripting (XSS) vulnerability in the authentication redirect flow (/auth/ endpoint) of Siemens Teamcenter, tracked as CVE-2026-58113 and rated CVSS v3.1 6.1 (MEDIUM, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). An unauthenticated attacker can craft a URL that injects JavaScript into the browser of an authenticated Teamcenter user, allowing actions to be performed and data read within that user's session. Affected versions are Teamcenter V2412 < V2412.0013, V2506 < V2506.0010, V2512 < V2512.2607 and V2606 < V2606.2607; fixed builds are available from Siemens. No CISA KEV listing, exploitation activity, or public proof-of-concept is reported in the source material, and no independent verification data was resolved for this item — the severity and exploitation state below are as published by the vendor and republished by CISA. For EMEA financial services the direct exposure is narrow (Teamcenter is a product lifecycle management platform, not a core banking or payment system), but any institution running it as an internal engineering/operations platform or consuming it through a managed service should treat the patch as routine-priority, not emergency.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

A vendor-published MEDIUM-severity XSS advisory with no reported exploitation, no incident, and no service disruption does not by itself trigger DORA Art. 17–19 incident-management or reporting duties, nor NIS2 Art. 23 reporting. Those obligations would only be engaged by an actual ICT-related incident meeting the applicable classification thresholds — for example, confirmed exploitation of CVE-2026-58113 resulting in unauthorised access to or modification of Teamcenter data. Likewise, DORA Art. 28–30 third-party risk provisions are not triggered by the mere existence of a vendor patch; they apply to the institution's contractual and concentration-risk management of the ICT provider relationship, which is a standing obligation rather than an event-driven one. If exploitation is subsequently detected, re-run this framing against DORA Art. 17, 18 and 19 and NIS2 Art. 23 at that point.

3. Technical analysis & attack chain

Confirmed attack chain (as described by the vendor advisory)

1. An unauthenticated remote attacker identifies a Teamcenter deployment and crafts a URL targeting the authentication redirect flow at the /auth/ endpoint, placing a JavaScript payload in a parameter that is reflected into an HTML attribute context.
2. The attacker delivers that URL to a target who holds an authenticated Teamcenter session — the advisory does not specify the delivery channel (email, chat, or other), so this step is inferred from the reflected-XSS class rather than stated.
3. The victim loads the crafted URL while authenticated. Because the application does not properly encode user-supplied input reflected into HTML attribute contexts, the injected JavaScript executes in the browser within the Teamcenter origin.
4. The CVSS vector records S:C (scope changed), meaning the vulnerable component's exploitation can affect resources beyond its security scope. The advisory states the outcome as the attacker being able to "read data or perform actions within the victim's Teamcenter session."
5. Impact is bounded by the victim's own privileges and session lifetime. The advisory does not describe persistence, credential theft, privilege escalation beyond the victim's rights, lateral movement, or server-side code execution.

Technical specifics relevant to a defender

• Vulnerable component: the authentication redirect flow, /auth/ endpoint, of Siemens Teamcenter. The flaw is improper neutralisation of input during web page generation in an HTML attribute context — not a text-node context — which is why standard output-encoding fixes that only cover element bodies are insufficient.
• Weakness class: CWE-79 (Improper Neutralization of Input During Web Page Generation, 'Cross-site Scripting'). The primary CISA item and the CISA republication both record CWE-79; there is no conflicting CWE classification to reconcile.
• Attack prerequisites: network reachability to the Teamcenter web interface (AV:N), no authentication required to deliver the payload (PR:N), no special conditions (AC:L), but user interaction is required (UI:R) — the victim must load the crafted URL.
• Affected and fixed versions:

• Deployment context (per the vendor advisory): critical infrastructure sectors listed as Critical Manufacturing and Information Technology; deployed worldwide; vendor headquartered in Germany.
• Credit: reported to Siemens by Enzo Alvarez of Bishop Fox.
• Advisory provenance: CISA ICSA-26-258-07 is a verbatim republication of Siemens ProductCERT SSA-157465, converted from the vendor's CSAF advisory. Siemens published SSA-157465 revision 1 on 2026-09-08; CISA republished it as revision 2 on 2026-09-15. CISA explicitly states it is not responsible for the editorial or technical accuracy of republished advisories.

Caveats and gaps

• No proof-of-concept, payload string, parameter name, or exploit code is present in the source material. The exact query parameter reflected into the attribute context is not disclosed.
• The source does not state whether the /auth/ endpoint is internet-facing by default, nor whether any authentication state is required for the reflection to occur.
• The primary CISA item's affected-version table omits the CVE identifier and the explicit version ranges that appear in the CISA republication; the CVE ID (CVE-2026-58113) and ranges above are taken from the republication. This is a presentation difference between two versions of the same advisory, not a factual conflict.
• Single-sourced. All technical detail here derives from one vendor advisory (Siemens SSA-157465) and its CISA republication. There is no independent research, exploitation telemetry, or third-party analysis corroborating the mechanism or impact. Treat the impact description as vendor-stated; verify before relying on it for risk acceptance.
• No CISA KEV entry and no remediation due-date are associated with this item in the source material. Do not assume one exists.

4. Mitigation & containment

P1 — within 24 hours

1. Inventory Teamcenter deployments and determine which of V2412, V2506, V2512 or V2606 are in use and at what build level. Any instance below the fixed build is in scope.
2. Apply the vendor fix for the deployed release line: V2412.0013, V2506.0010, V2512.2607 or V2606.2607 (or later). Patches are available via the Siemens support portal referenced in the advisory: https://support.sw.siemens.com/product/282219420/.
3. Confirm that no Teamcenter /auth/ endpoint is reachable directly from the internet. Siemens' standing guidance is to protect network access to the product with appropriate mechanisms and to operate it in a protected IT environment; CISA's standing ICS guidance is to minimise network exposure, place control-system networks behind firewalls isolated from business networks, and use VPN for remote access. Where remote access is required, terminate it through an authenticated gateway rather than exposing the application directly.

P2 — within 72 hours

4. Where patching cannot be completed immediately, deploy a WAF or reverse-proxy rule on the /auth/ path that rejects or sanitises requests whose query strings or parameters contain script-bearing markup (angle brackets, script, event-handler attribute patterns such as onerror/onload, or javascript: schemes). Treat this as a compensating control only — it does not fix the underlying encoding defect.
5. Enforce a Content-Security-Policy on the Teamcenter web tier that disallows inline script execution, which materially reduces the impact of any residual reflected-XSS path.
6. Review session configuration: shorten idle session timeouts for Teamcenter and confirm that session cookies are HttpOnly and Secure, so that script executing in the page origin cannot trivially read session material.
7. If the deployment is consumed as a managed or hosted service, raise the patch with the provider in writing and obtain the target build and date.

P3 — within 7 days

8. Retrospectively review web/proxy logs for requests to /auth/ carrying script-like payloads in parameters, and for authenticated sessions that performed unusual read or write actions immediately after such a request. The advisory gives no payload signature, so this review must be heuristic.
9. Brief engineering and operations staff who use Teamcenter on the risk of following unsolicited links into the application while authenticated, and on reporting unexpected page behaviour.
10. Record the patch state of each Teamcenter instance in the asset register so that future Siemens ProductCERT advisories for this product can be triaged against a known baseline.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source provides no hashes, domains, IP addresses, URLs, file paths, registry keys, mutexes, or payload strings. The following behavioural indicators are derived from the described mechanism and are single-sourced and heuristic — they describe what exploitation would look like, not observed activity. Verify before building enforcement around them.

Behavioural indicators

6. Detection

No YARA rule is emitted: the source contains no file artefacts, filenames, strings, mutexes, or command-line flags to build one from. A file-based rule would detect nothing.

The Sigma rule below targets the one genuine artefact in the source — the vulnerable /auth/ endpoint — combined with generic XSS markers. It is a heuristic detection for probing or exploitation attempts against the vulnerable flow, not a signature of a known payload. The XSS marker strings are generic tokens, not strings observed in this campaign; the source publishes no payload.

title: Siemens Teamcenter /auth/ Reflected XSS Attempt (CVE-2026-58113)
id: 8f2c1a44-7d19-4b0e-9c53-6a1e0b7d4f21
status: experimental
description: >
  Detects requests to the Siemens Teamcenter authentication redirect flow (/auth/)
  carrying script-bearing markup in the query string, consistent with attempted
  reflected cross-site scripting against CVE-2026-58113. Heuristic: the vendor
  advisory publishes no payload string, so generic XSS markers are used.
author: Adverse Trace
date: 2026/09/15
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/auth/'
  selection_payload:
    cs-uri-query|contains:

      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '%3Csvg'
  condition: selection_endpoint and selection_payload
falsepositives:

  - Legitimate application behaviour or security scanners submitting encoded markup
  - Penetration testing against the Teamcenter web tier
level: medium
tags:

  - attack.initial_access
  - attack.t1189
  - cve.2026.58113

Tuning note: field names (cs-uri-stem, cs-uri-query) follow IIS/W3C extended log format. Map to url.path / url.query for a Zeek or generic HTTP logsource, or to your WAF's request-URI field. Expect false positives from vulnerability scanners; baseline before alerting.

7. Sources

• CISA, "Siemens Teamcenter," ICS Advisory ICSA-26-258-07, published 2026-09-15 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07
• Siemens ProductCERT, SSA-157465 (referenced by the CISA republication; HTML and CSAF versions) — https://www.siemens.com/cert/advisories
• Siemens support portal, Teamcenter patch downloads — https://support.sw.siemens.com/product/282219420/

Context sources provided with this item (separate Siemens advisories, not corroboration for CVE-2026-58113 and not referenced in the analysis above):

• CISA, "Siemens Opcenter X," ICSA-26-202-03 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-03
• CISA, "Siemens Siveillance Video," ICSA-26-225-10 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10
• CISA, "Siemens Siveillance Video," ICSA-26-225-09 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-09
• CISA, "Siemens WinCC Certificate Manager," ICSA-26-174-01 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-01
• CISA, "Siemens Mendix Runtime," ICSA-26-209-02 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-02
• GitHub Security Advisories, "In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible," GHSA-jjhv-75hw-cg7g — https://github.com/advisories/GHSA-jjhv-75hw-cg7g

8. Adverse Trace position

We assess CVE-2026-58113 as a MEDIUM-severity, patch-routine item on the vendor's own published rating (CVSS v3.1 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No verified reference data was resolved for this item, so we are carrying the vendor/CISA-published score and severity rather than an independently verified assessment, and we note that no CISA KEV entry, no exploitation reporting, and no public proof-of-concept accompany it — we are not aware of any in-the-wild activity and we do not assert any. The user-interaction requirement and the absence of a server-side impact path keep this well below the emergency tier; the S:C scope change and the fact that the flaw sits in the authentication flow are the two factors that justify treating it as more than cosmetic, since script executing in the Teamcenter origin can act with the victim's session rights. Client impact for EMEA financial services is limited and indirect: Teamcenter is a PLM platform, so exposure is confined to institutions running it internally for engineering or operations, or consuming it via a managed service — it is not a payment, core banking, or customer-facing system. Our recommendation is to patch to the fixed build for the deployed release line within the normal monthly cycle, prioritising any instance whose /auth/ endpoint is internet-reachable, and to treat the WAF and CSP measures in §4 as compensating controls only. All technical detail in this advisory is single-sourced to Siemens SSA-157465 and its CISA republication; we will monitor for independent analysis, exploitation telemetry, or a CISA KEV addition and reissue if the picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.