CVE-2026-59241 SIMATIC WinCC - Privilege Escalation

SIMATIC WinCC V7.5 (All versions), V8.0 (< V8.0 Update 11), and V8.1 (< V8.1 Update 7) contain a privilege escalation caused by insufficient restriction of database role permissions, letting authenticated remote attackers with database access execute arbitrary commands on the host system.

CVSS base score 8.8 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
EPSS
0.50% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Privilege Escalation
Impact
Remote Code Execution, Privilege Escalation
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
13 October 2026
Updated
15 October 2026
Weakness
CWE-266

Vendor fix

Update to SIMATIC WinCC V8.0 Update 11, V8.1 Update 7 or later versions.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs