A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327…
At a glance
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.
Briefing
- IT leaders should assess whether affected SIMATIC IPC models are in their estate and consider updating to the latest versions to mitigate the risk of UEFI Secure Boot bypass.
- Businesses using the affected Siemens SIMATIC IPC devices should review the vulnerability details and follow Siemens' recommendations to ensure system security.
Questions to ask IT
- Are we affected by CVE-2026-72895, and which of our systems would be?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Nov?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-72895- 8.4 · HighExploitable only with local access without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Not listed
- ~0.1% estimated chance of attack in 30 days
- Not linked from the CVE record
- The vulnerability affects SIMATIC IPC BX-21A (all versions < V31.01.13), SIMATIC IPC RW-543A (all versions < V1.1.4), and other models with specific version thresholds.
- The issue involves CVE-2026-72895, allowing bypass of UEFI Secure Boot protections through the use of a test key.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- A vulnerability has been identified in several Siemens SIMATIC IPC models, including
- The vulnerability could allow an attacker to bypass UEFI Secure Boot protections by booting an operating system or UEFI application signed with a test key, even when Secure Boot is enabled.
- Siemens has released new versions for the affected products and recommends updating to the latest versions to address the issue.
Read the original reportCISA ICS Advisories(opens in a new tab)
- Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
- An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4…
- A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE ME…
- A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All version…
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 12:04 UK time
- Story3 Nov 2026, 12:04 UK time · 5d ago
Linked reporting from CISA ICS Advisories (official authority).
Read source (CISA ICS Advisories) - Story3 Nov 2026, 12:04 UK time · 5d ago
Linked reporting from CISA Cybersecurity Advisories (official authority).
Read source (CISA Cybersecurity Advisories)
2 entries so far. The timeline chart appears once this story has more history.
Sources
- CISA ICS AdvisoriesOfficial
Siemens SIMATIC IPCs
- CISA Cybersecurity AdvisoriesOfficial
Siemens SIMATIC IPCs
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327…
- ProbableSummary fact75% confidence
View CSAF Summary The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-72895