Strix
75K

CVE-2026-44415

CRITICALCVSS 9.1/10EPSS 0.46%

Last modified

CVE-2026-44415 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.

Description

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

Metrics

CVSS 3.1
9.1/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS 4.0
8.9/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.46%

38.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
SiemensIndustrial Edge Device Kit - arm64 V1.10< *
SiemensIndustrial Edge Device Kit - arm64 V1.11< *
SiemensIndustrial Edge Device Kit - arm64 V1.12< *
SiemensIndustrial Edge Device Kit - arm64 V1.13< *
SiemensIndustrial Edge Device Kit - arm64 V1.14< *
SiemensIndustrial Edge Device Kit - arm64 V1.15< *
SiemensIndustrial Edge Device Kit - arm64 V1.16< *
SiemensIndustrial Edge Device Kit - arm64 V1.17< *
SiemensIndustrial Edge Device Kit - arm64 V1.18< *
SiemensIndustrial Edge Device Kit - arm64 V1.19< *
SiemensIndustrial Edge Device Kit - arm64 V1.20< *
SiemensIndustrial Edge Device Kit - arm64 V1.21< *
SiemensIndustrial Edge Device Kit - arm64 V1.22< *
SiemensIndustrial Edge Device Kit - arm64 V1.23< *
SiemensIndustrial Edge Device Kit - arm64 V1.24< *
SiemensIndustrial Edge Device Kit - arm64 V1.25< *
SiemensIndustrial Edge Device Kit - arm64 V1.26< V1.26.2-1
SiemensIndustrial Edge Device Kit - arm64 V1.27< V1.27.1-1
SiemensIndustrial Edge Device Kit - arm64 V1.28< V1.28.0-6
SiemensIndustrial Edge Device Kit - arm64 V1.5< *
SiemensIndustrial Edge Device Kit - arm64 V1.6< *
SiemensIndustrial Edge Device Kit - arm64 V1.7< *
SiemensIndustrial Edge Device Kit - arm64 V1.8< *
SiemensIndustrial Edge Device Kit - arm64 V1.9< *
SiemensIndustrial Edge Device Kit - x86-64 V1.10< *
SiemensIndustrial Edge Device Kit - x86-64 V1.11< *
SiemensIndustrial Edge Device Kit - x86-64 V1.12< *
SiemensIndustrial Edge Device Kit - x86-64 V1.13< *
SiemensIndustrial Edge Device Kit - x86-64 V1.14< *
SiemensIndustrial Edge Device Kit - x86-64 V1.15< *
SiemensIndustrial Edge Device Kit - x86-64 V1.16< *
SiemensIndustrial Edge Device Kit - x86-64 V1.17< *
SiemensIndustrial Edge Device Kit - x86-64 V1.18< *
SiemensIndustrial Edge Device Kit - x86-64 V1.19< *
SiemensIndustrial Edge Device Kit - x86-64 V1.20< *
SiemensIndustrial Edge Device Kit - x86-64 V1.21< *
SiemensIndustrial Edge Device Kit - x86-64 V1.22< *
SiemensIndustrial Edge Device Kit - x86-64 V1.23< *
SiemensIndustrial Edge Device Kit - x86-64 V1.24< *
SiemensIndustrial Edge Device Kit - x86-64 V1.25< *
SiemensIndustrial Edge Device Kit - x86-64 V1.26< V1.26.2-1
SiemensIndustrial Edge Device Kit - x86-64 V1.27< V1.27.1-1
SiemensIndustrial Edge Device Kit - x86-64 V1.28< V1.28.0-6
SiemensIndustrial Edge Device Kit - x86-64 V1.5< *
SiemensIndustrial Edge Device Kit - x86-64 V1.6< *
SiemensIndustrial Edge Device Kit - x86-64 V1.7< *
SiemensIndustrial Edge Device Kit - x86-64 V1.8< *
SiemensIndustrial Edge Device Kit - x86-64 V1.9< *
SiemensSIMATIC HMI MTP1000 Unified Comfort Panel< *
SiemensSIMATIC HMI MTP1000 Unified Comfort Panel hygienic< *

Showing 50 of 98 affected configurations. See the CNA advisory for the full list.

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-44415?
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
How severe is CVE-2026-44415?
CVE-2026-44415 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.
How do I fix CVE-2026-44415?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-44415?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST