PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22923 Siemens CVE debrief

CVE-2026-22923 is a high-severity Siemens NX issue in the PDF export path. CISA’s advisory, republished from Siemens ProductCERT SSA-535115, says a local attacker with privileged access to NX running in managed mode could interfere with internal data during export and potentially cause arbitrary code execution.

Vendor
Siemens
Product
NX
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-10
Original CVE updated
2026-03-12
Advisory published
2026-02-10
Advisory updated
2026-03-12

Who should care

Siemens NX administrators, security teams, and OT/engineering workstation owners running NX—especially deployments that use managed mode and allow privileged local access.

Technical summary

The advisory describes a data validation vulnerability in Siemens NX affecting the PDF export process. The published guidance indicates exploitation requires local access and privileged access to the application in managed mode, with possible impact up to arbitrary code execution. CISA’s republication also distinguishes NX and NX (Managed Mode) as affected product names and links remediation to Siemens ProductCERT SSA-535115.

Defensive priority

High — prioritize if NX is deployed in managed mode on systems where privileged local users or administrators are present.

Recommended defensive actions

  • Update Siemens NX to V2512 or later, per the vendor remediation.
  • Limit privileged local access to systems running NX, especially managed-mode deployments.
  • Apply strong endpoint security, timely patching, and continuous monitoring for signs of compromise, as recommended by Siemens/CISA.
  • Review CISA and Siemens advisories for product-specific guidance before scheduling maintenance.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-26-043-08, which republishes Siemens ProductCERT SSA-535115. The source text states that the vulnerability is a data validation issue in PDF export, that exploitation requires local access plus privileged access in managed mode, and that impact could include arbitrary code execution. The advisory was first published on 2026-02-10 and updated through 2026-03-12; those dates are used only as advisory timing context, not as separate issue dates. No KEV entry is provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22923 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22923

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22923 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22923

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-535115.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-535115.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.