Medium severity · published Mar 26, 2026
CVE-2026-27663
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10)
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10). The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CPCI85 Central Processing/Communication · Siemens
before V26.10 · source: vendor
RB
RTUM85 RTU Base · Siemens
before V26.10 · source: vendor
In the news
VulnerabilityHigh
Siemens SICAM 8 Products
View CSAF
Summary
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE - RTUM85 Siemens has released new versions for the affected products and recommends to update to the latest versions.
The following versions of Siemens SICAM 8 Products are affected:
CPCI85 Central Processing/Communication vers:intdot/<26.10 (CVE-2026-27663, CVE-2026-27664)
RTUM85 RTU Base vers:intdot/<26.10 (CVE-2026-27663)
SICORE Base system vers:intdot/<26.10.0 (CVE-2026-27664)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.5
Siemens
Siemens SICAM 8 Products
Allocation of Resources Without Limits or Throttling, Out-of-bounds Write
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2026-27663
The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.
View CVE Details
Affe...
Apr 2, 2026·CISA Advisories
Affected product
CC
CPCI85 Central Processing/Communication
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27663
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27663
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-246443.html
seclists.org
http://seclists.org/fulldisclosure/2026/Apr/6
More from CPCI85 Central Processing/Communication
9.0
CVE-2024-3596
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
7.5
CVE-2026-27664
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < V26.10.0)
7.2
CVE-2026-54801
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0)
6.7
CVE-2026-54799
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0)
6.5
CVE-2026-54798
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0)