Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
ResearchSiemensOur summary
Bishop Fox researchers disclosed CVE-2026-58113, a reflected cross-site scripting flaw in the /auth/ login-redirect page of Siemens Teamcenter's Active Workspace interface. Because the page reflects query parameters unencoded into an HTML form and then auto-submits that form on load, an attacker-crafted link executes injected JavaScript the instant a logged-in victim opens it, no click or interaction beyond opening the URL required. During an authorized assessment, the researchers chained this into a state-changing call to Teamcenter's workflow API, silently granting one account surrogate-delegate rights over another user's session, which in a PLM system could translate into unauthorized approval of engineering changes or release of design data. Siemens rates the issue 8.5 (High) under CVSS 4.0 and has released fixed builds across the V2412, V2506, V2512, and V2606 branches, documented in advisory SSA-157465; no in-the-wild exploitation has been reported, but organizations are urged to update promptly and audit existing surrogate delegations for unexpected entries.
Below is the opening; the full story is at Bishop Fox.
From Bishop Fox
TL;DR
- Siemens Teamcenter is one of the most widely deployed product lifecycle management (PLM) platforms in the world, the system of record for the engineering designs, bills of materials, and approval workflows behind aircraft, vehicles, and industrial hardware. We found that a crafted link could execute JavaScript in the browser of a logged-in Teamcenter user. During an authorized assessment, we used it to silently grant one account the ability to act on behalf of another.
- CVE-2026-58113 is a reflected cross-site scripting (XSS) flaw in Teamcenter’s
/auth/login-redirect flow. The page reflects attacker-controlled query input into an auto-submitting HTML form without encoding it, and the form’s own automatic submission fires the injected code, no click required beyond opening the link. The attacker needs no Teamcenter account; the victim only needs to be authenticated when they open the URL. Siemens rates it 8.5 (High) under CVSS 4.0 and has shipped fixed builds.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.