CVE-2026-46746Disclosure(siemens / sinec_ins)

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for siemens sinec_ins systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).

siemens CVEs Back to dashboard

5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://cert-portal.siemens.com/productcert/html/ssa-860189.html

Weakness type (CWE)

CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sinec_ins

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-06-09); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

siemens

Products

sinec_ins

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Active Exploitation

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	1	Disclosure1
2026-06-23	1	Active Exploitation1

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc123d
Active Exploitation
Attackers chained OS command injection (CVE-2026-46746) with privilege escalation (CVE-2026-46748) to achieve root access on Siemens SINEC INS systems. TRC analysis shows lateral movement followed, demonstrating how industrial network compromises enable broad infrastructure access. Runtime segmentation helps limit blast radius in such scenarios. #CloudSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/icsa-26-174-04-sinec-ins-vulnerabilities-2026
Post summary
The report confirms attackers exploited OS command injection and privilege escalation CVEs to gain root access on Siemens SINEC INS systems, illustrating operational exploitation and lateral movement.
0000053
1.9K followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-46746 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFile… https://www.cve.org/CVERecord?id=CVE-2026-46746
Post summary
A new vulnerability, CVE-2026-46746, has been identified in SINEC INS, involving improper input sanitization on the /api/sftp/uploadFile endpoint, with no known exploits, patch, or active exploitation reported.
00000148
57.6K followersView on X

CPE platform detail8 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

8 of 8 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	siemens	sinec_ins	-	-	-
App	siemens	sinec_ins	1.0	-	-
App	siemens	sinec_ins	1.0	-	-
App	siemens	sinec_ins	1.0	-	-
App	siemens	sinec_ins	1.0	-	-
App	siemens	sinec_ins	1.0	-	-
App	siemens	sinec_ins	1.0	-	-
App	siemens	sinec_ins	1.0	-	-

Explore more

Back to dashboard siemens CVEs sinec_ins vulnerabilities