Siemens WinCC Database Privilege Escalation Vulnerability

Siemens SIMATIC WinCC

Siemens WinCC is affected by a database privilege escalation vulnerability that could allow an authenticated user to execute commands on the underlying host system.

Do this now

Apply the available Siemens WinCC fix and review accounts with database access.

Fix it

Siemens WinCC

On 8.0.xUpgrade to Siemens WinCC V8.0 Update 11
On 8.1.xUpgrade to Siemens WinCC V8.1 Update 7

First seen: 22 Oct 2026
Last update: 22 Oct 2026, 12:00 UTC
Fixed in: V8.1 Update 7
V8.0 Update 11
Identifiers: CVE-2026-59241
CVSS: 8.8
Source: news
On the menu as: Industrial & OT

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Siemens WinCC Database Privilege Escalation Vulnerability
Severity: high. Patch status: patched.
Affected: Siemens SIMATIC WinCC
Fixed in: V8.1 Update 7, V8.0 Update 11
Ids: CVE-2026-59241

Siemens WinCC is affected by a database privilege escalation vulnerability that could allow an authenticated user to execute commands on the underlying host system.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `V8.1 Update`, `V8.0 Update`. For each hit, compare the installed version with the fix on the same major line: V8.1 Update 7, V8.0 Update 11. If it's lower, give the exact upgrade command for the package manager this repo uses.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-59241") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
https://pwned.coffee/i/siemens-wincc-database-privilege-escalation-vulnerabilit-cve-2026-59241

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Siemens WinCC before V8.1 Update 7 V8.1 Update 7 CISA advisory
Siemens WinCC before V8.0 Update 11 V8.0 Update 11 CISA advisory
Score: CVSS 8.8 (high). CVSS 3.1 8.8 (CNA siemens) for CVE-2026-59241
Last checked: 24 Oct 2026, 18:17 UTC

Product	Affected	Fixed in	Source
Siemens WinCC	before V8.1 Update 7	V8.1 Update 7	CISA advisory
Siemens WinCC	before V8.0 Update 11	V8.0 Update 11	CISA advisory

Sources: KEV – CVE record ✓ Vendor ✓

Sources

cisa.gov: Siemens WinCC

Totalone hot coffee