PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33893 Siemens CVE debrief

CVE-2026-33893 is a high-severity Siemens Teamcenter issue in which a hardcoded obfuscation key is stored directly in the application. If an attacker extracts that key, it could be reused to gain unauthorized access. The advisory was published on 2026-05-12 and republished by CISA on 2026-05-14, with vendor fixes listed for affected Teamcenter branches.

Vendor
Siemens
Product
Teamcenter V2312
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Siemens Teamcenter administrators, product security teams, and defenders responsible for environments that run the affected Teamcenter releases.

Technical summary

CISA's advisory states that the application contains a hardcoded key used for obfuscation and stored directly in the application. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which indicates a network-reachable issue requiring no privileges or user interaction, with primary impact to confidentiality. The advisory lists fixed releases for Teamcenter V2312, V2406, V2412, and V2506.

Defensive priority

High

Recommended defensive actions

  • Upgrade affected Siemens Teamcenter deployments to the fixed release listed for your branch: V2312.0014 or later, V2406.0012 or later, V2412.0009 or later, or V2506.0005 or later.
  • Inventory Teamcenter versions across all environments and confirm which instances match the affected branches named in the advisory.
  • Until patched, limit exposure of Teamcenter services to trusted networks and accounts, following standard defense-in-depth and least-privilege practices.
  • Review the Siemens ProductCERT and CISA advisory references for any branch-specific guidance before scheduling maintenance windows.

Evidence notes

Primary evidence comes from CISA CSAF advisory ICSA-26-134-04, which republishes Siemens ProductCERT advisory SSA-827383. The supplied corpus gives a publish date of 2026-05-12 and a CISA republication date of 2026-05-14. The technical description is limited to a hardcoded obfuscation key and possible unauthorized access; no exploit details are provided, and no Known Exploited Vulnerability entry is listed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33893 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33893

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33893 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33893

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-827383.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-827383.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.