CVE-2026-24349
Medium
Elevated severity or exploit probability.
CVSS base
7.1
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
0.1%
0.0th percentile
CISA KEV
Not listed
Weakness / dates
CWE-313
Published 2026-06-09 · modified 2026-07-23
CVSS breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
| Attack Vector | L | Local |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | C | Changed |
| Confidentiality | H | High |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2026-06-09 — Published (NVD)
- 2026-07-23 — Last modified (NVD)
Description
A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.