Siemens Patches Teamcenter Authentication Redirect XSS Across Four Release Branches

Siemens has fixed a reflected cross-site scripting vulnerability in Teamcenter that could let a remote attacker abuse an authenticated user’s active session.

Tracked as CVE-2026-58113, the flaw affects the /auth/ authentication redirect flow in four Teamcenter release branches. An attacker does not need an account, but exploitation requires an authenticated user to open a specially crafted URL.

Siemens initially released its advisory on September 8, 2026. CISA republished the Siemens ProductCERT advisory on September 15, 2026, to increase its visibility among industrial and critical-infrastructure operators.

Four Teamcenter branches require updates

CVE-2026-58113 affects Siemens Teamcenter V2412, V2506, V2512, and V2606. Deployments running versions below the following thresholds remain vulnerable:

Teamcenter branch	Affected versions	First fixed version
V2412	All versions below V2412.0013	V2412.0013
V2506	All versions below V2506.0010	V2506.0010
V2512	All versions below V2512.2607	V2512.2607
V2606	All versions below V2606.2607	V2606.2607

Administrators should upgrade to these releases or a later version available for the corresponding branch. Siemens recommends using the latest available release rather than treating the minimum fixed build as a long-term target.

Teamcenter is used for product lifecycle management and related engineering workflows. In affected organizations, authenticated sessions may expose product data, designs, production information, or other operational resources according to each user’s permissions.

The affected deployments are worldwide. CISA associates the product with the Critical Manufacturing and Information Technology sectors, while Siemens is headquartered in Germany.

The malicious script enters through the /auth/ redirect flow

The vulnerability results from incorrect encoding of user-controlled data during web-page generation. It is classified as CWE-79, or improper neutralization of input associated with cross-site scripting.

In this case, an attacker constructs a URL targeting Teamcenter’s /auth/ endpoint and places JavaScript payload data in an input handled by the authentication redirect process. The application reflects that input into an HTML attribute without encoding it safely for that context.

When an authenticated user loads the URL, the browser interprets the injected content as executable script rather than inert text. The code then runs within the security context associated with the victim’s Teamcenter session.

This is a reflected XSS issue: the malicious value travels in the request and appears in the immediate response. The attacker does not need to store the payload within Teamcenter beforehand.

The attack therefore has two distinct roles. The attacker can remain unauthenticated, while the targeted user must already have a valid Teamcenter session and must open the crafted link. Delivery could involve any channel capable of directing a user to a URL, although no specific campaign or delivery technique has been reported.

Successful exploitation inherits the victim’s access

JavaScript running in an authenticated Teamcenter context may read information available to the targeted user or initiate actions through that user’s session. The practical impact consequently depends on the victim’s authorization level.

A compromised session belonging to a narrowly restricted user would expose fewer resources than one associated with engineering administrators, project owners, or other privileged personnel. Organizations should therefore prioritize systems used by accounts with broad access to sensitive product and operational information.

Siemens and CISA assign CVE-2026-58113 a CVSS v3.1 base score of 6.1, rated Medium. Its full vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The vector reflects a network-reachable attack with low complexity and no privileges required by the attacker. User interaction is mandatory. The changed-scope rating accounts for the injected script crossing a security boundary and operating through the browser session.

The assessment records low confidentiality and integrity impacts. It assigns no direct availability impact, meaning the documented scenario does not involve disrupting Teamcenter’s operation.

A Medium rating should not obscure the importance of the victim’s role. Session-level actions can become consequential when the targeted account has access to valuable engineering or manufacturing assets.

No confirmed exploitation or KEV deadline has been reported

There are no reported affected organizations, confirmed exploitation attempts, or known malicious campaigns associated with CVE-2026-58113. Specific indicators of compromise have not been published.

The available NVD information also does not identify the vulnerability as part of CISA’s Known Exploited Vulnerabilities catalog. Consequently, no KEV addition date or federal remediation deadline is available and none should be inferred.

The absence of a KEV entry means there is no disclosed evidence here that attackers are exploiting the flaw in the wild. It does not eliminate the exposure created by internet-accessible Teamcenter installations or by users who can be persuaded to follow external links.

Enzo Alvarez of Bishop Fox reported the vulnerability to Siemens. The vendor is tracking its response through Siemens ProductCERT advisory SSA-157465.

Patching is the primary defense

Administrators should first inventory Teamcenter servers, identify their release branches, and compare the installed builds with the fixed-version thresholds. Every vulnerable instance should be upgraded to at least the relevant corrected release.

Internet-exposed installations deserve immediate attention. Teams should also prioritize deployments used by privileged accounts or those providing access to sensitive design, production, and product lifecycle data.

Until updates are complete, organizations can reduce—but not remove—the risk through several controls:

• Restrict direct internet exposure for Teamcenter and related control-system components.
• Place affected systems behind firewalls and enforce access controls appropriate to their operational role.
• Separate manufacturing or control environments from general corporate networks.
• Use secured and fully updated VPN infrastructure where remote access is necessary.
• Limit privileged browsing and warn authenticated users against opening unexpected Teamcenter authentication links.
• Monitor requests to the /auth/ flow for unusual parameters, encoded script content, or suspicious external referral patterns.
• Review anomalous actions performed by authenticated accounts, particularly after unusual redirect requests.
• Apply browser and web-security controls capable of limiting script execution where compatible with Teamcenter operations.

No specific workaround has been disclosed that fully neutralizes the vulnerable input handling. Network segmentation, monitoring, and user awareness are compensating measures rather than substitutes for the Siemens update.

Defenders should validate changes against operational risk

Manufacturing and engineering environments often require controlled maintenance windows because application changes can affect connected workflows and dependent systems. Siemens recommends performing an impact analysis and risk assessment before deploying defensive changes.

Organizations should test the corrected Teamcenter release against authentication, engineering, and product lifecycle workflows before broad deployment where operational constraints require staged updates. That process should not become an indefinite delay, especially for externally reachable systems.

After patching, defenders should confirm that every node in clustered or distributed deployments has been upgraded. They should also verify that older instances, testing servers, and forgotten externally accessible environments are not still running vulnerable builds.

Security teams investigating suspicious activity should preserve relevant web, authentication, proxy, and session logs. Because no vulnerability-specific indicators have been released, detection must focus on abnormal /auth/ requests and unexpected actions performed through authenticated sessions. Suspected malicious activity can be reported through established organizational procedures and to CISA where appropriate.