Bulletins

Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.

A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user’s session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim’s Teamcenter session. Siemens …

View CSAF

Summary

Successful exploitation of this vulnerability could allow any authenticated user to create projects.

The following versions of Inductive Automation Ignition are affected:

• Ignition <=8.1.53 (CVE-2026-77393)

View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands.

The following versions of OPCFoundation OPC UA LocalDiscoveryServer (LDS) are affected:

• UA-LDS-Installers <1.04.420 (CVE-2026-77477)

View CSAF

Summary

Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover.

The following versions of Rockwell Automation 1756-ENBT Module are affected:

• 1756-ENBT module vers:all/* (CVE-2025-10478)

View CSAF

Summary

Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk.

The following versions of Tycon Systems TPDIN-Monitor-WEB2 (Update A) are affected:

• TPDIN-Monitor-WEB2 <2.4.5 (CVE-2026-61884, CVE-2026-55985)
…

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory reset, wipe credentials, or retrieve sensitive information.

The following versions of Tycon Systems TPDIN-Monitor-WEB3 are affected:

• TPDIN-Monitor-WEB3 <=2.2.9 (CVE-2026-77847, CVE-2026-82712, CVE-2026-82684)