CVE-2026-85114

7.5High

Published 13 Oct 2026 · NVD status: Deferred

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on integrity
Weakness: CWE-22

The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Ad · In-content banner

NVD description

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

References

https://cert-portal.siemens.com/productcert/html/ssa-390352.html

Source: nvd.nist.gov/vuln/detail/CVE-2026-85114