Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-15 | 1 | Active Exploitation1 |
| 2026-10-15 | 3 | Active Exploitation1Disclosure1Exploit1 |
🧱 Breakdown of CVE-2026-58113: Reflected XSS in Siemens Teamcenter's Login Redirect Blog: https://bishopfox.com/blog/xss-siemens-teamcenters-login-redirect-cve-2026-58113 Author: Enzo Alvarez (@bishopfox) https://t.co/Dopmeh28Km
CVE-2026-58113, CVSS 8.5 (High), is a zero-interaction reflected XSS in Siemens Teamcenter's /auth/ login-redirect flow. An attacker with no account of their own can silently reassign who can approve engineering releases by sending a single link to an authenticated user. Key findings: - CVE-2026-58113 lives in the /auth/ endpoint used during Teamcenter Active Workspace SSO. The server reflects arbitrary query parameters and parameter names directly into the attributes of a hidden HTML form without encoding them. Because the page immediately calls document.getElementById('autoSubmit').submit() via a body onLoad handler, the injected attribute fires the moment the page loads. No hover, no click, no second action. The payload structure closes the form's action attribute early with a URL-encoded double quote (%22), injects an onformdata handler as a new form attribute, and re-opens the trailing quote to keep the markup valid. - The onformdata event is the critical piece. It fires during the browser's entry-list construction phase of form submission, including when submission is triggered programmatically by form.submit(). That makes it a reliable zero-interaction sink in this context, one that is under-represented in standard XSS payload sets and many WAF signatures. Bishop Fox confirmed execution in Firefox and notes behavior may vary across browser engines. - The weaponized payload went further than a proof-of-concept dialog. The injected handler called Teamcenter's /tc/RestServices/Workflow-2014-06-Workflow/setSurrogate REST API via a fetch request with credentials: include, carrying the victim's session cookies. Teamcenter uses a double-submit CSRF token pattern, which requires the token to be JavaScript-readable from document.cookie, so the injected script simply read it and echoed it in the X-Xsrf-Token header, bypassing CSRF protection entirely. keepalive: true ensured the POST completed even as the page navigated away to the SSO destination. The test confirmed a second account was silently added as a surrogate delegate with a delegation window of roughly one year. - Surrogate delegation in a PLM system is not a minor setting. A surrogate can approve engineering change orders, release controlled design data, and modify bills of materials, the actions that move physical hardware into production. Beyond surrogate abuse, any Teamcenter API the victim is authorized to call is reachable from the injected script: data exfiltration, record tampering, and privilege escalation are all constrained only by server-side authorization. Every authenticated user is a viable target, making phishing a natural delivery vector. Siemens SSA-157465 covers four affected branches: V2412 fixed in V2412.0013, V2506 fixed in V2506.0010, V2512 fixed in V2512.2607, and V2606 fixed in V2606.2607. Practitioner takeaway: patch first using SSA-157465, then run a surrogate delegation audit before you close the ticket. Pull active and historical delegation records, flag any assignments users did not initiate, and correlate creation timestamps against authentication-redirect activity and account logins from the same window. For detection without running the payload, inspect reverse proxy, WAF, or application logs for requests to /auth/ containing %22 adjacent to HTML attribute-style text, event handler names including onformdata, onfocus, onerror, or onload in query values, or unexpected arbitrary parameter names on that endpoint. A hit is a lead to investigate the associated session and account, not a confirmed compromise. The report's own detection guidance is the place to start building those signatures. #DFIR_Radar
Post summary
A detailed technical analysis of CVE-2026-58113 describes a zero-interaction reflected XSS in Siemens Teamcenter's SSO flow enabling silent surrogate delegation, including a weaponized exploit payload with CSRF bypass, with patches available via SSA-157465.
TRC analysis shows attackers exploited CVE-2024-58113 to weaponize XSS in Siemens Teamcenter's login flow. The payload silently modified delegation settings via authenticated API calls, granting surrogate privileges to approve engineering changes and access manufacturing workflows. #ZeroDay #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/siemens-teamcenter-xss-login-redirect-cve-2026-58113
Post summary
The text reports confirmed active exploitation of CVE-2024-58113 in Siemens Teamcenter, where attackers weaponized XSS in the login flow using a payload to escalate privileges via delegation setting modifications.
Source: https://bishopfox.com/blog/xss-siemens-teamcenters-login-redirect-cve-2026-58113
Post summary
The text is a bare URL linking to a Bishop Fox blog post about CVE-2026-58113, an XSS vulnerability in Siemens Teamcenter's login redirect. No exploit, PoC, patch, or active exploitation details are provided in the text itself.
TRC analysis shows attackers exploiting CVE-2026-58113 to inject JavaScript into Siemens Teamcenter sessions, then pivoting across manufacturing systems using compromised credentials. Runtime segmentation helps contain lateral movement within industrial networks. #CloudSecurity :link: Full TRC analysis: https://aviatrix.ai/threat-research-center/siemens-teamcenter-xss-vulnerability-cve-2026-58113-icsa-26-258-07
Post summary
The text reports active exploitation of CVE-2026-58113, an XSS vulnerability in Siemens Teamcenter, where attackers inject JavaScript to compromise sessions and pivot across manufacturing systems.