August 7, 2026
Siemens SICAM 8 Vulnerabilities: Patch Now
August 7, 2026
On July 16, 2026, CISA published advisory ICSA-26-197-05 covering four vulnerabilities in Siemens SICAM 8 products. These are industrial control system devices used in power grids, substations, and critical manufacturing. If your facility or a vendor managing your facility runs CPCI85 firmware below V26.20 or SICORE firmware below V26.20.0, you have exposed equipment right now.
Most small and mid-size businesses in NJ aren't running substations, but energy companies, manufacturers, and utilities in this region absolutely are. If you're in facilities management, work with operational technology, or manage IT for an industrial client, this is your problem too.
The highest-severity finding is CVE-2026-54801, scored 7.2 HIGH. It lets an authenticated attacker bypass security controls through the web API and escalate their privileges to admin level. That's not a theoretical edge case. Anyone with a low-level account on the device could potentially own it.
CVE-2026-54799 is the one that keeps me up at night. It breaks the firmware update signature validation process. An attacker who exploits this can install malicious firmware and get persistent code execution. Persistent means it survives reboots. It means the device is compromised at a level that's very hard to clean up.
CVE-2026-54798 exposes a debugging interface over HTTP endpoints. An authenticated attacker can crash the web process and cause denial of service. CVSS 6.5 MEDIUM, but on a device managing power infrastructure, "denial of service" means something a lot more serious than a website going down.
CVE-2026-54800 is the quieter one. The device ships with OPC UA security mechanisms disabled by default. CVSS 4.8 MEDIUM. OPC UA is the communication protocol these devices use to talk to other industrial systems. Shipping with security off by default is a bad design choice, and it means a lot of deployed units are sitting open unless someone explicitly turned security on. Many didn't.
Siemens has released fixed firmware. The path forward is straightforward in principle, harder in practice with OT gear.
Siemens recommends validating updates before applying them in your production environment and having trained staff supervise the process. That's standard advice for OT, but it also means you shouldn't hand this off to someone who only knows IT. Industrial firmware updates can brick equipment if done wrong.
If you can't patch immediately, restrict network access to these devices. Segment them from your broader network. That won't close the authentication bypass vulnerabilities for users already inside, but it limits exposure from the outside.
This isn't the first time we've seen ICS firmware ship with insecure defaults or exposed debug interfaces. We wrote about a similar pattern when a flaw in XZ Utils hit industrial automation gear, and the lesson was the same: OT devices get less patching attention than Windows servers, and attackers know it.
If you're managing a mixed IT/OT environment, firmware inventory matters as much as software inventory. You need to know what versions are running before a CISA advisory tells you they're wrong.
For the authentication and privilege escalation issues specifically, the approach mirrors what we covered in our post on the Cisco UCM exploit: authenticated-attacker vulnerabilities are only as dangerous as your access controls are weak. Tight account hygiene, minimal privilege, and monitoring for unusual API calls all reduce your exposure even before a patch lands.
Get the firmware updated, verify OPC UA security is on, and document what you did. If you want a second set of eyes on your OT or IT exposure, book an IT assessment with Exine and we'll work through it with you.
CPCI85 Central Processing/Communication versions below V26.20 and SICORE Base system versions below V26.20.0 are confirmed affected by all four CVEs. Siemens released fixed versions and recommends updating immediately through the official support packages for each hardware platform.
Directly, probably not. But if you provide IT services to manufacturers, utilities, or facilities that use Siemens SICAM 8 devices, you share responsibility for that environment. Vendors and MSPs managing mixed IT/OT networks need to account for ICS firmware in their patch processes.
An attacker can push malicious firmware to the device by exploiting a broken signature check. Once installed, that firmware persists through reboots. The device is then compromised at a hardware level, which is significantly harder to recover from than a typical software infection.
According to the CISA advisory, the default configuration disables all OPC UA security mechanisms. This is tracked as CVE-2026-54800. Patching alone may not fix this. After updating firmware, administrators should explicitly verify and enable OPC UA security settings in the device configuration.
