CVE-2026-59241 with a CVSS score of 8.8 is a database privilege escalation vulnerability in SIMATIC WinCC caused by insufficient restriction of permissions assigned to a database role. The affected versions are stated as SIMATIC WinCC V7.5 vers:all/*, SIMATIC WinCC V8.0 vers:intdot/<8.0.0.11, and SIMATIC WinCC V8.1 vers:intdot/<8.1.7. The flaw is an incorrect privilege assignment in the database access layer, allowing an authenticated remote attacker who already has database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed. The attack vector is network-based, requires low privileges, does not require user interaction, and can lead to full compromise of the affected host. Business impact includes unauthorized control of industrial or operational systems, potential disruption to processes, data integrity loss, and significant operational risk in critical infrastructure sectors such as critical manufacturing, transportation systems, energy, healthcare and public health, financial services, and government services and facilities.
We recommend you to update SIMATIC WinCC to version V8.0 Update 11 or V8.1 Update 7 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-59241 with a CVSS score of 8.8 is a database privilege escalation vulnerability in SIMATIC WinCC caused by insufficient restriction of permissions assigned to a database role. The affected versions are stated as SIMATIC WinCC V7.5 vers:all/*, SIMATIC WinCC V8.0 vers:intdot/<8.0.0.11, and SIMATIC WinCC V8.1 vers:intdot/<8.1.7. The flaw is an incorrect privilege assignment in the database access layer, allowing an authenticated remote attacker who already has database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed. The attack vector is network-based, requires low privileges, does not require user interaction, and can lead to full compromise of the affected host. Business impact includes unauthorized control of industrial or operational systems, potential disruption to processes, data integrity loss, and significant operational risk in critical infrastructure sectors such as critical manufacturing, transportation systems, energy, healthcare and public health, financial services, and government services and facilities.
We recommend you to update SIMATIC WinCC to version V8.0 Update 11 or V8.1 Update 7 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]