VulnSocial

CVE-2026-34223Disclosure

LOWCVSS 8.6 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-22); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-22: 2Mentions · 2026-09-25: 1Active Exploitation · 2026-09-22: 1Technical Details · 2026-09-22: 2Technical Details · 2026-09-25: 109-2209-25
Signal classification2 categories
Disclosure
266.7%
Active Exploitation
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-222
Active Exploitation1Disclosure1
2026-09-251
Disclosure1
Full discourse3 posts
  • CyberWorldOps@CyberWorldOps
    Disclosure

    CISA warns that CVE-2026-34223 in Siemens Desigo CC can let a compromised graphics document write files to a client system, with potential for lateral movement. Review the advisory. #CyberSecurity #ICS https://cyberworldops.eu/en/malicious-graphics-files-put-siemens-desigo-cc-clients-at-risk-of-code

    Post summary

    CISA warns of CVE-2026-34223 in Siemens Desigo CC, describing a vulnerability enabling file writes via compromised graphics documents and lateral movement, and directs users to review the advisory. Technical details are provided, but no active exploitation or patch information is explicitly mentioned.

    0000038
    13 followersView on X
  • NewsTongue@NewsTongueX
    Disclosure

    🔴 Siemens Desigo CC code-execution flaw affects all V6, V7 instances worldwide A Client Code Execution vulnerability (CVE-2026-34223) impacts Siemens Desigo CC family V6 and V7 across all versions. The flaw stems from insufficient input validation in user-defined graphics documents; malicious scripts embedded in graphics files execute on client instances when opened, potentially compromising the operating system and enabling lateral movement. Affected sectors: Critical Manufacturing, Commercial Facilities (worldwide deployment).

    Post summary

    The tweet discloses a code-execution vulnerability (CVE-2026-34223) affecting Siemens Desigo CC V6 and V7 worldwide, caused by insufficient input validation in graphics documents that can lead to malicious script execution and potential system compromise.

    0000051
    926 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis reveals attackers exploiting CVE-2026-34223 in Siemens Desigo CC systems use malicious graphics documents to execute arbitrary code on building automation clients. Once compromised, these systems become pivot points for lateral movement across industrial networks. Runtime segmentation helps contain such post-compromise activity in OT environments. #CloudSecurity #ZeroTrust 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/siemens-desigo-cc-cve-2026-34223-client-code-execution

    Post summary

    The text reports that attackers are actively exploiting CVE-2026-34223 in Siemens Desigo CC systems using malicious graphics documents to achieve arbitrary code execution and lateral movement. No PoC, exploit tool, or vendor patch is explicitly identified.

    0000046
    2.0K followersView on X

Explore more

Back to dashboard