Siemens Siveillance Control

CVE-2026-50093

September 22, 2026 · CISA (US-CERT) · Severity: CRITICAL

This advisory identifies a critical vulnerability in Siemens Siveillance Control's Open Interface Services web module that allows arbitrary file uploads, potentially granting an attacker root access. The vulnerability affects multiple versions of Siveillance Control and Siveillance Control Pro. Siemens has released patches and recommends updating to the latest versions. 📌 **Analyst Note:** Given the high CVSS score of 9.0 and the potential for root-level compromise, this vulnerability should be treated as a priority for patching in critical infrastructure environments. Organizations should also review network segmentation to limit exposure of the OIS web module.

Key Takeaways

A vulnerability in the Siemens Siveillance Control Open Interface Services web module allows an attacker to upload arbitrary files, potentially leading to unauthorized root-level access on the OIS server.
The affected products include Siveillance Control and Siveillance Control Pro versions OIS 3.x.y and 4.x.y, which are used in critical manufacturing, communications, and commercial facilities worldwide.
Siemens has released patches for the affected versions, and users are strongly recommended to update to the latest versions to prevent full compromise of the OIS environment.