Siemens Teamcenter
Act NowCVSS 7.5ICS-CERT ICSA-26-134-04May 12, 2026
Siemens
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Siemens Teamcenter versions V2312, V2406, V2412, and V2506 are affected by multiple vulnerabilities in authentication, data validation, and access control that could allow attackers to bypass security controls, read sensitive design and manufacturing data, or modify product information without authorization. The vulnerabilities are related to improper error handling (CWE-754), insufficient input validation (CWE-79), and hardcoded credentials (CWE-798).
What this means
What could happen
Attackers could gain unauthorized access to sensitive design and manufacturing data stored in Teamcenter, or manipulate product data in ways that could affect manufacturing processes downstream.
Who's at risk
Manufacturing and engineering departments using Siemens Teamcenter for product lifecycle management, design data storage, and manufacturing process planning. This includes companies with CAD/CAM systems, product data management workflows, and distributed engineering teams that rely on Teamcenter to manage intellectual property and manufacturing specifications.
How it could be exploited
An attacker with network access to a Teamcenter instance can exploit authentication or data validation flaws to bypass security controls, read confidential product and manufacturing information, or modify engineering data without proper authorization.
Prerequisites
- Network access to Teamcenter web interface
- Teamcenter instance running vulnerable version (V2312 before 2312.0009, V2406 before 2406.0006, V2412 before 2412.0009, or V2506 before 2506.0005)
remotely exploitableno authentication requiredlow complexityhigh EPSS score (37.8%)affects confidentiality of product data
Exploitability
Likely to be exploited — EPSS score 40.3%
Affected products (6)
6 with fix
Remediation & Mitigation
0/7
Do now
0/1WORKAROUNDRestrict network access to Teamcenter web interface to authorized engineering and manufacturing staff only using firewall rules or network segmentation
Schedule — requires maintenance window
0/6Patching may require device reboot — plan for process interruption
Teamcenter V2312
HOTFIXUpdate Teamcenter V2312 to version 2312.0009 or later
HOTFIXUpdate Teamcenter V2312 to version 2312.0014 or later
Teamcenter V2406
HOTFIXUpdate Teamcenter V2406 to version 2406.0006 or later
HOTFIXUpdate Teamcenter V2406 to version 2406.0012 or later
Teamcenter V2412
HOTFIXUpdate Teamcenter V2412 to version 2412.0009 or later
Teamcenter V2506
HOTFIXUpdate Teamcenter V2506 to version 2506.0005 or later
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/823b1648-3736-4c70-9a68-5cd2c633b707Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.