A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All version…
At a glance
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Are we affected by CVE-2026-89208, and which of our systems would be?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Nov?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-89208- 6.9 · MediumExploitable over the network without any account, and no one has to click or open anything. Low impact on confidentiality.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Not listed
- ~0.3% estimated chance of attack in 30 days
- Not linked from the CVE record
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behaviour, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Read the original reportCISA Cybersecurity Advisories(opens in a new tab)
- Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
- An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4…
- A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327…
- A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 12:04 UK time
- Story3 Nov 2026, 12:04 UK time · 5d ago
Linked reporting from CISA Cybersecurity Advisories (official authority).
Read source (CISA Cybersecurity Advisories) - Story3 Nov 2026, 12:04 UK time · 5d ago
Linked reporting from CISA ICS Advisories (official authority).
Read source (CISA ICS Advisories)
2 entries so far. The timeline chart appears once this story has more history.
Sources
- CISA Cybersecurity AdvisoriesOfficial
Siemens Capital Embedded AR Classic
- CISA ICS AdvisoriesOfficial
Siemens Capital Embedded AR Classic
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All version…
- ProbableSummary fact75% confidence
View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behaviour, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-89208