Siemens patches Teamcenter login flaw that could hijack engineer sessions

Key points

• Siemens fixed a reflected cross-site scripting flaw, CVE-2026-58113, in the Teamcenter authentication redirect flow, disclosed on 8 September 2026.
• The bug carries a CVSS v3.1 base score of 6.1 (medium) and needs the victim to click a crafted link.
• Fixed builds are V2412.0013, V2506.0010, V2512.2607 and V2606.2607.
• CISA republished Siemens advisory SSA-157465 on 15 September 2026 for critical manufacturing and IT operators.
• Enzo Alvarez of Bishop Fox reported the flaw to Siemens.

Siemens has released fixes for a flaw in Teamcenter, its product lifecycle management software used by manufacturers to design and track parts, that could let an attacker take actions inside an engineer's logged-in session.

The vulnerability sits in the sign-in redirect path at /auth/. It is a reflected cross-site scripting bug, meaning the web page copies text from a URL straight into the page without sanitising it, so an attacker can smuggle in JavaScript that runs in the victim's browser.

To pull it off, the attacker sends a Teamcenter user a booby-trapped link. If the user is already signed in and clicks it, the injected code runs with that user's permissions, allowing the attacker to read data or perform actions inside the session.

Siemens tracks the issue as CVE-2026-58113, scored 6.1 out of 10 on the CVSS v3.1 scale. The CWE-79 classification covers cross-site scripting broadly. Bishop Fox researcher Enzo Alvarez reported the bug to Siemens ProductCERT. Advisory SSA-157465 was published on 8 September 2026; CISA republished it on 15 September 2026.

Which versions are affected?

Four Teamcenter release lines need updating. Siemens has issued a fixed build for each one.

Any build below the listed number is vulnerable. Updates are available through the Siemens support portal.

How serious is this for manufacturers?

Medium, not critical, but worth patching quickly. The attack needs a user to click a link, which caps the damage. Teamcenter holds design files and change records that run a factory, so a hijacked session is not a small problem.

Two limits keep the score moderate. The attacker can't break in unassisted; they need an authenticated user to load a crafted URL. Confidentiality and integrity impact are both rated low, with no availability impact. What lifts the score is scope change: code running through the /auth/ endpoint can reach data the browser would normally keep separate.

We covered the September 2026 industrial Patch Tuesday on 9 September, where Siemens appeared alongside Schneider Electric and Aveva. This advisory adds a web-layer angle that was absent from that round: the threat isn't to a controller directly but to the engineer managing it.

My read, having watched Siemens advisories since we first covered one on 7 July: attackers aren't chasing Teamcenter for volume, they're after targeted access to a specific manufacturer's IP. A phishing email pointing at a legitimate Siemens domain is exactly the lure that gets clicked.

What should defenders do now?

Update to the fixed version for your release line, and treat any Teamcenter instance reachable from the public internet as a priority.

CISA's republication repeats standard guidance for industrial systems: keep control-system networks off the internet, place them behind firewalls, and use VPNs for remote access while keeping those VPNs patched. Siemens points operators to its industrial security guidance for network hardening.

Users who receive unexpected Teamcenter links, particularly ones with long query strings, should not click them and should forward the message to their security team.

Common questions

Do I need to do anything as an end user?

If your employer runs Teamcenter, expect an update from IT. Don't click Teamcenter links you didn't ask for, even if the domain looks right.

Has this bug been exploited in the wild?

Neither Siemens nor CISA has reported any exploitation as of the 15 September 2026 republication.