CVE-2026-24349Disclosure(siemens / simatic_wincc_unified_pc_runtime)

LOWCVSS 8.2 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for siemens simatic_wincc_unified_pc_runtime systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.

siemens CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://cert-portal.siemens.com/productcert/html/ssa-063511.html

Weakness type (CWE)

CWE-313

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

simatic_wincc_unified_pc_runtime

Threat summary

Active exploitation appears in 1 classified signals
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-09); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

siemens

Products

simatic_wincc_unified_pc_runtime

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Active Exploitation

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	2	Disclosure1General1
2026-06-23	2	Active Exploitation1Disclosure1

Full discourse4 posts

Israel@f1tym1123d
Disclosure
CVE-2026-24349 in Siemens WinCC Certificate Manager insufficiently protects key material, allowing local attackers to extract sensitive information. https://ift.tt/FNWayVm
Post summary
CVE‑2026‑24349 reveals that Siemens WinCC Certificate Manager inadequately protects key material, enabling local attackers to extract sensitive data, with no PoC, patch, or active exploitation reported.
0000048
1.0K followersView on X
Aviatrix Threat Research Center@aviatrixtrc123d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-24349 can extract cryptographic keys from Siemens WinCC systems to escalate privileges and move laterally across industrial networks. Runtime segmentation helps contain post-compromise activity in OT environments. #OTSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/icsa-26-174-01-cve-2026-24349
Post summary
TRC analysis reports that CVE-2026-24349 is actively exploited to extract cryptographic keys and facilitate lateral movement in Siemens WinCC environments, highlighting the need for runtime segmentation.
0000042
1.9K followersView on X
Infoflowcloud@infoflowcloud137d
General
🚨*CVE* CVE-2026-24349 A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified… https://www.cve.org/CVERecord?id=CVE-2026-24349 ----- Traducción: Se ha identificado… http://infoflow.cloud`
Post summary
The tweet simply announces that CVE-2026-24349 has been identified in certain SIMATIC WinCC Unified PC Runtime versions, linking to the CVE record but providing no additional technical or mitigation information.
0000027
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-24349 A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified… https://www.cve.org/CVERecord?id=CVE-2026-24349
Post summary
A new CVE (CVE-2026-24349) for a vulnerability in SIMATIC WinCC Unified PC Runtime versions V16 and V17 has been identified, with the text providing only the CVE number and a link to the official record without further technical, exploit, or patch details.
00000163
57.6K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	siemens	simatic_wincc_unified_pc_runtime	-	-	-
App	siemens	simatic_wincc_unified_pc_runtime	21	-	-
App	siemens	simatic_wincc_unified_pc_runtime	21	-	-

Explore more

Back to dashboard siemens CVEs simatic_wincc_unified_pc_runtime vulnerabilities

What researchers are saying

CVE-2026-24349

Israel[verified]@f1tym1Disclosure

CVE‑2026‑24349 reveals that Siemens WinCC Certificate Manager inadequately protects key material, enabling local attackers to extract sensitive data, with no PoC, patch, or active exploitation reported.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

TRC analysis reports that CVE-2026-24349 is actively exploited to extract cryptographic keys and facilitate lateral movement in Siemens WinCC environments, highlighting the need for runtime segmentation.

Infoflowcloud@infoflowcloudGeneral

The tweet simply announces that CVE-2026-24349 has been identified in certain SIMATIC WinCC Unified PC Runtime versions, linking to the CVE record but providing no additional technical or mitigation information.

CVE@CVEnewDisclosure

A new CVE (CVE-2026-24349) for a vulnerability in SIMATIC WinCC Unified PC Runtime versions V16 and V17 has been identified, with the text providing only the CVE number and a link to the official record without further technical, exploit, or patch details.