Reflected XSS (CVE‑2026‑58113) in Siemens Teamcenter Authentication Flow Threatens PLM Sessions
What It Is – A reflected cross‑site scripting flaw in the /auth/ redirect flow of Siemens Teamcenter allows an unauthenticated attacker to inject JavaScript into an authenticated user’s session. Successful exploitation can let the attacker read data or perform actions on behalf of the victim.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑58113) with a CVSS v3 base score of 6.1 (moderate). No public exploit code has been observed, but the attack requires only a crafted URL, making exploitation feasible for opportunistic actors.
Affected Products – Siemens Teamcenter versions:
- V2412 < 2412.0013
- V2506 < 2506.0010
- V2512 < 2512.2607
- V2606 < 2606.2607
Why It Matters for Trust & Control Assurance
- Application‑level input validation – The flaw highlights the need for controls that enforce proper encoding of user‑supplied data, a core control objective across many frameworks.
- Session integrity & authentication – An attacker can hijack an authenticated session, underscoring the importance of continuous monitoring of authentication flows and evidencing that patches are applied promptly.
- Audit‑ready evidence – Demonstrating that the vulnerable versions have been remediated provides defensible proof for auditors and enterprise buyers who demand a verifiable security posture.
Recommended Actions
- Identify all Teamcenter instances and verify their version numbers.
- Apply Siemens‑provided patches or upgrade to the latest released version.
- Deploy a web‑application firewall rule to block malicious
/auth/query strings. - Add the patch status to your control‑mapping repository and capture evidence for audit.
- Monitor authentication logs for anomalous redirects or script‑injection attempts.
Source: CISA Advisory – ICSA‑26‑258‑07