CVE Tools
Track your stack

Siemens

2,382 CVEs tracked since 1999. Since Aug 2021, 18 of them reached CISA KEV.

Siemens CVEs per month

Aug 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Siemens CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-08350
2021-09581
2021-10310
2021-11290
2021-12492
2022-01231
2022-02370
2022-03261
2022-04261
2022-05330
2022-06300
2022-07510
2022-0870
2022-09230
2022-10360
2022-11240
2022-12440
2023-01120
2023-02460
2023-03no snapshot
2023-04180
2023-05180
2023-06160
2023-07260
2023-08360
2023-09220
2023-10232
2023-11190
2023-12180
2024-01240
2024-02290
2024-0390
2024-0490
2024-05550
2024-06140
2024-07410
2024-08240
2024-09220
2024-10350
2024-11341
2024-12140
2025-014 or fewer
2025-02160
2025-03250
2025-04810
2025-05380
2025-0680
2025-07180
2025-08300
2025-09101
2025-10120
2025-11150
2025-12231
2026-015 or fewer
2026-02110
2026-03120
2026-0471
2026-05222
2026-0680
2026-0770
2026-08210
2026-09150
2026-10364
2026-110

Products

The products that kept showing up in Siemens's monthly top three, with their CVEs summed over those months.

  1. Telecontrol Server Basic681 month
  2. Tecnomatix Plant Simulation534 months
  3. Sinema Remote Connect Server403 months
  4. Solid Edge SE2023373 months
  5. Tecnomatix Plant Simulation V2302374 months
  6. Teamcenter Visualization V14.2363 months
  7. Simcenter Femap344 months
  8. Scalance W1750D Firmware323 months
  9. Teamcenter Visualization324 months
  10. Sinec Nms295 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Siemens.

  1. CVE-2026-89209A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All...6.8
  2. CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder9.8
  3. CVE-2026-109619RCE via stale global state8.1
  4. CVE-2026-109618RCE via OOM corruption9.8
  5. CVE-2026-110936A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could a...6.7
  6. CVE-2026-102076A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethern...7.5
  7. CVE-2026-102075A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethern...7.5
  8. CVE-2026-102074A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethern...7.5
  9. CVE-2026-102073A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethern...8.2
  10. CVE-2026-89208A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo...5.3
  11. CVE-2026-89206A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of schedu...6.3
  12. CVE-2026-89205A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operation...6.3
  13. CVE-2026-89204A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an...5.4
  14. CVE-2026-89203A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide...4.3
  15. CVE-2026-89202A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an...6.5

The record

Peak rank
#7 in Jul 2021
Busiest month shown
Apr 2025, 81 CVEs
Months with a KEV entry
12 since Aug 2021
Monthly snapshots
154 since 1999
Siemens's full record, month by month