CVE-2026-85114

Last refreshed2026-10-13

Status: UPDATED | Advisory ID: CVE-2026-85114

Key Details

CVE	CVE-2026-85114
CVSS Score / Version	7.5 (High) / CVSS v3.1
Updated	2026-10-13
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is high; availability impact is none.
Affected products	Siemens .NET Client Library for SIMATIC S7 Webserver API
Classified as	CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Siemens	.NET Client Library for SIMATIC S7 Webserver API

Vendor

Product

Affected Versions

Patch Status

Siemens

.NET Client Library for SIMATIC S7 Webserver API

Subsystems	General OT
Sectors	Multiple

What to Know

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.

This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application. (NVD)

What to Do

Monitor Siemens's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-85114
CVE	https://www.cve.org/CVERecord?id=CVE-2026-85114

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-85114

CVE