High severity · published Apr 14, 2026
CVE-2026-24032
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC)
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.
This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SINEC NMS · Siemens
before V4.0 SP3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24032
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-801704.html
More from SINEC NMS
9.0
CVE-2021-40438
mod_proxy SSRF
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2025-40736
A vulnerability has been identified in SINEC NMS (All versions < V4.0)
9.8
CVE-2024-33698
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1…
9.8
CVE-2024-23810
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1)