Siemens Desigo CC Client Code Execution vuln has no patch
CVE-2026-34223 lets a malicious graphics file compromise the client OS; the only countermeasure today is locking down who can open one.
TL;DR
CISA republished a Siemens advisory for CVE-2026-34223 (CVSS 8.2), a client code execution vulnerability in Desigo CC V6 and V7. The affected application executes scripts embedded in user-defined graphics documents without sufficient input validation, an attacker who crafts a malicious graphics file and convinces a user to open it can write arbitrary files to the OS and move laterally. Siemens has no fix available. The recommended mitigation is restricting Graphics application access to the minimum users who need it.
The vulnerability sits in how Desigo CC handles user-defined graphics documents. When the script inside one of those documents is modified to include malicious commands, opening the file triggers code execution on the client application instance. From there, an attacker can write arbitrary files to the underlying operating system, full client compromise, with lateral movement in play. The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) reflects the user-interaction requirement but also the scope change and high impact across confidentiality, integrity, and availability.
Siemens disclosed the vulnerability on September 8, 2026, and CISA republished the advisory on September 22 as ICSA-26-265-05. Michelin CERT reported the issue to Siemens.
No patch is available for V6 or V7. Siemens's recommended countermeasure is straightforward but limited: evaluate the authorization policy for the Graphics application under least-privilege principles so only required users have access to the configuration. That's an access-control stopgap, not remediation.
The advisory does not mention Desigo CC V8 or V9. Whether those versions are immune or simply weren't tested isn't stated. For facilities running V6 or V7 in critical manufacturing or commercial environments, the practical posture is: restrict the Graphics app and wait.
This is the latest in a long history of high-severity findings for the Desigo CC product family, including a CVSS 10.0 deserialization flaw in 2021, a 9.8 client-side authentication issue in 2022, and a 9.8 OpenSSL-based remote code execution vulnerability disclosed in July 2026, which affected V7, V8, and V9 versions prior to 9.0.1.
Published ·Deep Fathom