VulnSocial

CVE-2026-67367Active Exploitation

MEDIUMCVSS 9.2 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-23

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-22: 2Active Exploitation · 2026-09-22: 1Patch / Workaround · 2026-09-22: 1Technical Details · 2026-09-22: 209-22
Signal classification2 categories
Active Exploitation
150.0%
Patch
150.0%
Referenced assets1 URL
Full discourse2 posts
  • NewsTongue@NewsTongueX
    Patch

    🔴 Siemens SIMOVE Fleetmanager, SIPLANT path traversal flaw exposes credentials Siemens released patches for path traversal vulnerability (CVE-2026-67367) affecting SIMOVE Fleetmanager versions 3.1–4.0 and SIPLANT versions 1.7–3.1. Unauthenticated remote attackers can read arbitrary files from the operating system, potentially exposing credential stores, private keys, and configuration secrets. • SIMOVE Fleetmanager V3.1 < 3.1.13, V3.2 < 3.2.4, V3.3 < 3.3.2, V4.0 < 4.0.1 • SIPLANT V1.7, V2.2, V3.0, and V3.1 < 3.1.4 • Deployed worldwide in critical manufacturing infrastructure

    Post summary

    Siemens has released patches for CVE-2026-67367, a path traversal flaw in SIMOVE Fleetmanager and SIPLANT products that could allow unauthenticated remote attackers to read arbitrary files and expose credentials; the advisory lists specific fixed versions for affected product lines.

    0000046
    926 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2026-67367 in Siemens industrial systems can read arbitrary files without authentication, accessing credential stores and private keys. This path traversal flaw creates a clear entry point for lateral movement across manufacturing networks. Runtime segmentation helps contain post-compromise activity in OT environments. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/siemens-simove-siplant-path-traversal-cve-2026-67367

    Post summary

    The TRC analysis reports active exploitation of CVE-2026-67367, a path traversal flaw in Siemens industrial systems allowing unauthenticated arbitrary file read and credential theft, facilitating lateral movement in OT environments.

    0000045
    2.0K followersView on X

Explore more

Back to dashboard