CVE-2026-85114 Siemens CVE debrief

Who should care

Defenders responsible for .NET Client Library for SIMATIC S7 Webserver API deployments should assess exposure and prioritize updates to prevent potential file writes. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify current versions, restrict access, and update to V3.3.61 or later.

Why it matters

CVE-2026-85114 allows attackers to manipulate ticket responses and write arbitrary files. Defenders should verify current versions, restrict access, and update to V3.3.61 or later.

• Potential for arbitrary file writes outside intended directories
• Possible file overwrites if enabled
• Need for verification of current version and exposure
• Priority for updating to version V3.3.61 or later

Technical summary

The .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61) does not properly validate filenames received from remote servers during ticket downloads. This allows an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory. If overwriting is enabled, existing files accessible to the application can be replaced. The vulnerability can be mitigated by verifying and updating to version V3.3.61 or later, and restricting access to ticket responses.

Defensive priority

Defenders should prioritize verifying and updating to version V3.3.61 or later, and restrict access to ticket responses.

Recommended defensive actions

• Verify and update .NET Client Library for SIMATIC S7 Webserver API to version V3.3.61 or later
• Restrict access to ticket responses to prevent manipulation
• Monitor for suspicious file writes outside intended download directories
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but specific instances of exploitation are not documented. The vulnerability is identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). The CVE record was published on 2026-10-13T09:18:57.499Z and has not been modified since then. There is no information on known or unknown affected scope, but defenders should verify current versions and restrict access to ticket responses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.