Reflected XSS in Siemens Teamcenter auth flow lets attackers hijack sessions
The CVSS 6.1 score understates the operational risk for defense contractors, Teamcenter handles CUI and ITAR data in production PLM workflows, and there's no interim mitigation beyond patching.
TL;DR
CISA published an advisory for CVE-2026-58113, a reflected cross-site scripting vulnerability in the Teamcenter authentication redirect flow (/auth/ endpoint). An unauthenticated remote attacker can inject JavaScript into an authenticated user's browser via a crafted URL. Siemens has patched all four affected version lines: V2412 (< V2412.0013), V2506 (< V2506.0010), V2512 (< V2512.2607), and V2606 (< V2606.2607). No configuration workaround exists, the fix is a version bump. Enzo Alvarez of Bishop Fox reported the vulnerability to Siemens.
The reflected XSS sits in the authentication redirect flow, the part of Teamcenter that handles login handoffs. An attacker crafts a URL, sends it to a Teamcenter user, and if the user clicks, arbitrary JavaScript executes in their authenticated session. The advisory doesn't enumerate what an attacker can do from inside that session, but the CVSS vector spells it out: the scope is changed (S:C), meaning the injected script runs in the victim's browser context with access to whatever the Teamcenter web interface exposes, read access to data, modification of data, and the ability to trigger actions the victim is authorized to perform.
Four version lines are in scope, which covers the current and near-future release cadence. Siemens V2412, V2506, V2512, and V2606 all ship the vulnerable code. The remediation is straightforward (update to the patched build) but there's no config toggle or mitigation to apply in the meantime. If you're running an affected version and you can't patch immediately, your only lever is user awareness training around clicking untrusted links, which is not a control anyone wants to hang a POA&M on.
For defense contractors and critical manufacturing firms, the exposure is real even if the severity score looks pedestrian. Teamcenter is a PLM platform, it manages product data through the design, manufacturing, and sustainment lifecycle. When that data is CUI or covered by ITAR, a session hijack that lets an attacker read or modify records inside the application isn't a theoretical compliance problem. It's the kind of incident that triggers reporting obligations and, depending on the contract, may require disclosure to the DCMA DIBCAC assessor during the next CMMC assessment. A "medium" CVSS score doesn't absolve the system owner of explaining why a known-exploitable XSS on an authentication endpoint went unpatched.
Published ·Deep Fathom