CVE-2026-102076: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…

High severity · published Oct 13, 2026

CVE-2026-102076

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE…

7.5

CVSS

0.4%

EPSS

On KEV

Description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user-supplied input in upload code. This could allow an unauthenticated remote attacker to cause a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 36% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

APOGEE MBC (PPC) (BACnet) · Siemens

0 · source: vendor

APOGEE MBC (PPC) (P2 Ethernet) · Siemens

0 · source: vendor

APOGEE MEC (PPC) (BACnet) · Siemens

0 · source: vendor

APOGEE MEC (PPC) (P2 Ethernet) · Siemens

0 · source: vendor

APOGEE PXC Compact (BACnet) · Siemens

before V3.5.7 · source: vendor

APOGEE PXC Compact (P2 Ethernet) · Siemens

before V2.8.21 · source: vendor

APOGEE PXC Modular (BACnet) · Siemens

before V3.5.7 · source: vendor

APOGEE PXC Modular (P2 Ethernet) · Siemens

before V2.8.21 · source: vendor

TALON TC Compact (BACnet) · Siemens

before V3.5.7 · source: vendor

TALON TC Modular (BACnet) · Siemens

before V3.5.7 · source: vendor

In the news

VulnerabilityHigh

Siemens APOGEE, TALON and Desigo PXC/PXM Products

View CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens APOGEE, TALON and Desigo PXC/PXM Products are affected: APOGEE MBC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MBC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (BACnet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE MEC (PPC) (P2 Ethernet) vers:all/* (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Compact (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (BACnet) vers:intdot/<3.5.7 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) APOGEE PXC Modular (P2 Ethernet) vers:intdot/<2.8.21 (CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076) Desigo PXC00-E.D vers:intdot/>=2.3 (CVE-2026-892...

CVE-2026-102073 CVE-2026-102074 CVE-2026-102075

Oct 22, 2026·CISA Advisories

Affected product

APOGEE MBC (PPC) (BACnet)

Siemens

All APOGEE MBC (PPC) (BACnet) CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-102076

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-102076

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-333035.html