High severity · published Oct 13, 2026
CVE-2026-72895
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO /…
7.7
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
SIMATIC IPC BX-21A · Siemens
before V31.01.13 · source: vendor
SI
SIMATIC IPC RW-543A · Siemens
before V1.1.4 · source: vendor
SI
SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G · Siemens
before V28.01.15 · source: vendor
In the news
VulnerabilityHigh
Siemens SIMATIC IPCs
View CSAF
Summary
The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions.
The following versions of Siemens SIMATIC IPCs are affected:
SIMATIC IPC BX-21A vers:intdot/<31.01.13 (CVE-2026-72895)
SIMATIC IPC RW-543A vers:intdot/<1.1.4 (CVE-2026-72895)
SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G vers:intdot/<28.01.15 (CVE-2026-72895)
CVSS
Vendor
Equipment
v3 7.7
Siemens
SIMATIC IPC BX-21A
1 Vulnerability
Use of Default Cryptographic Key
Background
Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
CVE-2026-72895
A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentialit...
Oct 22, 2026·CISA Advisories