CISA flags CVSS 10 Siemens Opcenter X JWT bypass
For OT teams, the practical trigger is network reachability: credentials and user interaction are absent from the attack path.
TL;DR
CISA republished Siemens ProductCERT SSA-096828 for Siemens Opcenter X versions before V2604, assigning CVSS v3.1 10 to CVE-2026-56451. The JWT validation flaw lets an unauthenticated remote attacker forge tokens and impersonate any user, including administrators. Critical manufacturing operators worldwide, including defense industrial base suppliers, municipal IT shops and contractors using Opcenter X, should move to V2604 or isolate affected instances. The advisory gives only general network-exposure guidance, so this is a patch-or-isolate clock.
CISA’s July 21 republication of Siemens ProductCERT SSA-096828 is the sort of Industrial Control Systems advisory that should skip the meeting queue. Opcenter X before V2604 fails to properly validate the algorithm specified in the JSON Web Token header, mapped to CWE-347 and CVE-2026-56451. With a CVSS v3.1 score of 10 and vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, the advisory describes a remote path that requires no credentials or user interaction and can end with an attacker impersonating any user, including administrators.
Siemens’ fix is blunt: update to V2604 or later. The CISA page adds the usual ICS hygiene, minimize network exposure, keep control system devices off the internet, place control system networks and remote devices behind firewalls, isolate them from business networks, and keep VPNs current. Those guardrails matter, but they do not repair the product’s authentication boundary. If an affected instance remains reachable, the control depends on segmentation rather than the application rejecting forged tokens.
The affected universe is critical manufacturing worldwide, but the procurement reader should hear that broadly. Defense industrial base suppliers, municipal IT teams and contractors running Opcenter X need version inventory first, internet and cross-network exposure second, and patch sequencing third. The advisory does not state whether Siemens or CISA has seen active exploitation. That leaves responders with two jobs while engineers close the reachable instances: check for impossible-user or forged-token activity, and verify that downstream environments are not trusting a compromised Opcenter X instance by assumption.
Published ·Deep Fathom