Malicious Graphics Files Put Siemens Desigo CC Clients at Risk of Code Execution

A high-severity vulnerability in Siemens Desigo CC products can let embedded scripts write arbitrary files to a client operating system when a user displays a compromised graphics document.

The flaw, tracked as CVE-2026-34223, stems from inadequate validation of scripts contained in user-defined graphics. Successful exploitation could compromise the affected workstation and potentially give an attacker a path for lateral movement through the organization.

CISA assigned the issue a CVSS v3.1 score of 8.2, or High. Michelin CERT reported the vulnerability to Siemens.

Exploitation begins with a manipulated graphics document

An attacker must first create a malicious user-defined graphics document or modify an existing one. The attacker must then convince a user with sufficient privileges to display that document in an affected Desigo CC client.

Once opened, the embedded script executes inside the client application instance. Insufficient input validation allows the script to cause arbitrary files to be written to the underlying operating system.

This is not described as a remotely exploitable, unauthenticated attack against an internet-facing service. The published CVSS vector identifies a local attack vector, low attack complexity, low privileges and required user interaction:

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

The scope-changing rating indicates that a successful attack can affect resources beyond the vulnerable application’s original security authority. Confidentiality, integrity and availability impacts are all rated High.

The practical risk depends heavily on the privileges of the person opening the document and the access available from that client system. Siemens and CISA warn that compromise could extend beyond the initial workstation through lateral movement.

No attack indicators, malicious document samples or specific post-exploitation techniques have been disclosed. There is also no published evidence in the available information that CVE-2026-34223 is being actively exploited.

CISA and NVD materials disagree on the affected scope

The affected-product lists are not consistent across the available records.

The CISA industrial control systems advisory marks the following Siemens product families as affected:

• Desigo CC family V6, all versions
• Desigo CC family V7, all versions

The available NVD record describes a broader set of affected products:

• Desigo CC ClickOnce Client V6 and V7, all versions
• Desigo CC family V8 and V9, all versions
• Desigo CC Flex Client V6 and V7, all versions
• Desigo CC Installed Client V6 and V7, all versions

The discrepancy has not been resolved. In particular, the NVD material includes Desigo CC family V8 and V9, while those versions do not appear in CISA’s affected-products summary. It also names ClickOnce, Flex and Installed Client variants separately.

Organizations should therefore avoid assuming that deployments outside the narrower CISA list are unaffected. Until Siemens provides clearer product-level guidance, asset owners should inventory the specific Desigo CC family version and client type used in each environment.

The vulnerability crosses application and operating-system boundaries

CVE-2026-34223 is classified as CWE-94, Improper Control of Generation of Code, commonly described as code injection.

The security boundary at issue is the handling of scripts embedded within Desigo CC graphics documents. These documents may be legitimate operational assets, but the application does not sufficiently validate their scripted content before processing it.

The attack chain has several required stages:

1. An attacker creates or alters a user-defined graphics document.
2. That document reaches a user of an affected Desigo CC client.
3. The user, operating with sufficient privileges, displays it.
4. The embedded script runs within the client application.
5. The script writes arbitrary files to the client operating system.
6. The resulting compromise may be used to affect the workstation or move further into the organization.

User interaction is necessary, but that condition does not make the flaw low risk. Graphics documents may appear routine in building-management or industrial environments, particularly when shared through trusted operational workflows.

Restricting who can create, modify and distribute these files can reduce exposure. Monitoring changes to established graphics documents may also help identify tampering, although no vendor-specific detection method has been published.

Worldwide deployments span two critical-infrastructure sectors

Siemens Desigo CC products are deployed worldwide. CISA associates the affected technology with the Critical Manufacturing and Commercial Facilities sectors.

That scope places the vulnerable clients in environments where building management, facility operations and industrial functions may be connected to broader enterprise networks. A compromised client could therefore create consequences beyond the application itself, depending on network segmentation and account privileges.

Siemens is headquartered in Germany. Michelin CERT is credited with reporting the vulnerability to the vendor.

CISA lists the advisory’s initial release and publication date as September 8, 2026. It initially republished Siemens ProductCERT advisory SSA-330084 on September 22, 2026, through a direct conversion of Siemens’ CSAF security advisory.

No product-specific patch is identified

The published guidance does not identify a fixed release, software update or product-specific workaround for CVE-2026-34223. It also does not provide a version that administrators can use as a confirmed safe baseline.

Siemens advises customers to protect network access to affected devices, configure deployments according to its Industrial Security operational guidelines and follow the relevant product manuals. Technical questions can be directed to Siemens ProductCERT.

Until a concrete fix is available, defenders should concentrate on reducing opportunities to deliver and execute untrusted graphics documents. Practical measures include:

• Restricting creation and modification of user-defined graphics to authorized accounts.
• Reviewing how graphics documents are transferred between systems and users.
• Applying least privilege to Desigo CC client operators.
• Monitoring for unexpected files written by Desigo CC client processes.
• Investigating unexplained changes to trusted graphics documents.
• Separating affected clients from systems they do not need to reach.
• Preserving suspicious documents and related host telemetry for analysis.

No file names, hashes, process patterns or other indicators of compromise have been released. Defenders must therefore rely on behavioral monitoring and document-integrity controls rather than matching known malicious artifacts.

Network isolation can limit post-exploitation movement

CISA recommends keeping control systems and remote devices away from the public internet. Affected systems should sit behind firewalls, with control networks separated from business networks wherever operationally possible.

Where remote access is required, organizations should use secure methods such as VPNs and keep the VPN software updated. Security teams must also account for the condition of devices connecting through those remote-access channels, since a VPN does not protect against an already compromised endpoint.

Any mitigation should be evaluated against operational and safety requirements before deployment. Organizations that identify suspected malicious activity should follow their established incident-response procedures and report relevant findings to CISA.

CVE-2026-34223 is not listed with a CISA Known Exploited Vulnerabilities status or remediation deadline in the available NVD information. That means there is no stated federal KEV deadline, but it does not remove the need to control untrusted graphics documents and constrain affected clients while the product scope and remediation path remain unsettled.