SIMATIC WinCC: Privilege escalation via database role permissions
Summary
Multiple SIMATIC WinCC versions (SCADA system) do not sufficiently restrict the permissions of a database role. An authenticated attacker with database access can escalate privileges and execute arbitrary commands on the WinCC host, which can lead to a full system compromise. The attacker needs valid database access, so the risk is highest where database accounts are widely held or the WinCC database is reachable from untrusted networks.
Affected
- SIMATIC WinCC V7.5: all versions
- SIMATIC WinCC V8.0: all versions before V8.0 Update 11
- SIMATIC WinCC V8.1: all versions before V8.1 Update 7
Fixed in
- SIMATIC WinCC V7.5: no fix available yet
- SIMATIC WinCC V8.0: update to V8.0 Update 11 or later
- SIMATIC WinCC V8.1: update to V8.1 Update 7 or later
Workaround
- SIMATIC WinCC V7.5: Unknown. No vendor workaround was found in the sources reviewed.
- Generic: restrict database accounts and host access on WinCC systems, and isolate WinCC from untrusted networks.
Exploitation
- Siemens and CISA report no active exploitation.
- Not listed in the CISA or EU known-exploited catalogues.
- No public proof of concept found for this CVE.
Our recommendation
- Identify the installed WinCC version on every system.
- Update V8.0 and V8.1 systems to the fixed versions, planned together with the OT vendor or integrator and the maintenance windows.
- For V7.5, where no fix exists, apply the generic measures above and monitor for unusual database or command activity.
- Remove unnecessary database and WinCC accounts.
- Check that WinCC database ports and servers are not reachable from office networks, the internet or remote access paths such as VPN or RDP.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Siemens Security Advisory SSA-550198 cert-portal.siemens.com
- CISA ICS Advisory ICSA-26-295-13 www.cisa.gov
- Security Boulevard: Daily OT Security News, October 24, 2026 securityboulevard.com
- OffSeq Radar: CVE-2026-59241 radar.offseq.com
- VulDB: CVE-2026-59241 (third-party score differs) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:35.
Original description (NVD)
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.