securitytabs

CVE-2026-59241

High8.7

A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.

CVSS
8.7v4.0
EPSS (exploit probability)
0.5%42th pct
CISA KEV
Not listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS held steady from 0.5% on 2026-10-14 to 0.5% on 2026-10-22, ranging 0.5%–0.5% across 9 daily scores.
2026-10-14 → 2026-10-22 · 9 days · 0.5%–0.5%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-220.5%41.9%
2026-10-210.5%41.8%
2026-10-200.5%41.6%
2026-10-190.5%41.5%
2026-10-180.5%41.4%
2026-10-170.5%41.4%
2026-10-160.5%41.4%
2026-10-150.5%41.3%
2026-10-140.5%41.3%

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Coverage1 article

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-22 20:34 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-22 19:34 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-22 20:34 UTC; score date 2026-10-22
  • KEV: CISA KEV, fetched 2026-10-22 20:34 UTC