A remote request can pull keys and passwords out of two Siemens plant systems.

Siemens has released corrected versions of two of its industrial software products after finding a fault that lets an outsider ask the software for files it was never built to hand over. Nobody has to log in first. The request arrives over the network, the software answers it, and what comes back can include the passwords and private keys it holds in order to reach everything else it manages.

Both products sit inside manufacturing operations, and CISA, the United States infrastructure security agency that republished the Siemens notice, records them as deployed worldwide. If a site runs either one, the people who need this are whoever keeps the maintenance record for that software and whoever holds the contract with the integrator who installed it.

The unusual part is what the fault does not do. It does not stop a line, change a setting or crash anything. Siemens records no effect at all on whether the system keeps running: the whole of the harm is in what can be read.

Nothing stops, and that is the difficulty

An outage announces itself. A file being read does not. There is no alarm to acknowledge, no call-out, nothing that reaches a shift handover, which means the cost here is deferred rather than avoided.

Software that manages a fleet of vehicles or the plant around them has to hold the secrets it needs to reach everything underneath it. That is what it is for. The advisory is explicit about the category of material at risk: credential stores, private keys and the secrets kept in configuration. On the evidence here, those are not the prize in themselves. They are what gets used on the next thing.

The practical reading is that an attacker who reads the configuration once does not need the flaw again. The credential taken this month is used next month, through a front door that records a successful login like any other. By then the corrected version is installed, and the incident, if it ever surfaces, looks like a credentials problem rather than a software one.

Reaching the system is the whole of the attack. There is no password to obtain first and no one to trick into clicking anything, which is why the severity attached to it is high even though the machine carries on as normal throughout.

What the affected operations should be asking

The first question is not about the update at all. It is whether this software was ever reachable from beyond the plant network, and for how long, because that is what separates a routine maintenance item from an exposure with a window attached to it.

The second is worth putting to the supplier in writing: is there a corrected release for the version actually installed on this site? For the fleet management product the answer is straightforward. For three of the older plant product lines the advisory lists no fixed version at all and sends the customer to Siemens support instead, so an operator running one of those cannot close the matter out from the document alone.

The third belongs to whoever administers accounts rather than whoever patches software, and the two are rarely the same person: what do the credentials stored on that machine unlock, and would a login using them look any different in the logs from a legitimate one?

There is also a question of provenance worth knowing about. The CISA document is a straight republication of the Siemens advisory, converted from the vendor's own machine-readable format, and CISA states plainly that it is not responsible for the accuracy of what it contains and refers enquiries to Siemens ProductCERT, which reported the issue in the first place.

A fault that breaks nothing leaves nothing to notice, and that is what makes this a decision rather than a repair. The update closes the door. It does not answer what went through it, and the longer that question sits, the fewer logs remain to answer it with.

The technical record

• Advisory: ICSA-26-265-07, published by CISA on 22 September 2026, republished unchanged from Siemens ProductCERT SSA-517424, initially issued 8 September 2026.
• Vulnerability: CVE-2026-67367, relative path traversal, CWE-23.
• Mechanism: the file-serving endpoint of the products' embedded web server does not correctly neutralise traversal sequences in a supplied path, so an unauthenticated remote attacker can read arbitrary files from the host operating system, with credential stores, private keys and configuration secrets named as material potentially exposed.
• Score: CVSS v3.1 base 8.6, high, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. Confidentiality impact high, integrity and availability none, scope changed.
• Affected: SIMOVE Fleetmanager V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1; SIPLANT V1.7, V2.2 and V3.0 at all versions; SIPLANT V3.1 before V3.1.4.
• Remediation: update SIMOVE Fleetmanager to V3.1.13, V3.2.4, V3.3.2 or V4.0.1 as applicable; SIPLANT V3.1 to V3.1.4 or later via Siemens customer support. No fixed version is listed for SIPLANT V1.7, V2.2 or V3.0. Listed mitigations are restricting service access rights to project files and restricting network access to affected devices, and the advisory closes with the usual segmentation and remote-access guidance.
• Sector and deployment: critical manufacturing, worldwide, vendor headquartered in Germany.
• Reporting: Siemens ProductCERT reported the vulnerability to CISA, and the document makes no statement about exploitation activity either way.