CVE-2026-24349: SIMATIC WinCC Information Disclosure Flaw

CVE-2026-24349 Overview

CVE-2026-24349 is an information disclosure vulnerability in the WinCC Certificate Manager component of Siemens SIMATIC WinCC Unified PC Runtime. The flaw stems from insufficient protection of cryptographic key material, allowing a local attacker to extract sensitive information from affected systems. The vulnerability is tracked under CWE-313: Cleartext Storage in a File or on Disk and affects all versions of WinCC Unified PC Runtime V16 through V20, plus V21 prior to Update 2. Siemens disclosed the issue in advisory SSA-063511.

Critical Impact
A local attacker with access to the operator workstation can recover protected key material from the WinCC Certificate Manager, undermining the trust chain that secures Human-Machine Interface (HMI) communications in industrial environments.

Affected Products

SIMATIC WinCC Unified PC Runtime V16, V17, V18, V19, V20 (all versions)
SIMATIC WinCC Unified PC Runtime V21 (all versions prior to V21 Update 2)
WinCC Certificate Manager component on affected runtimes

Discovery Timeline

2026-06-09 - CVE-2026-24349 published to NVD
2026-06-09 - Siemens publishes Security Advisory SSA-063511
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-24349

Vulnerability Analysis

The vulnerability resides in the WinCC Certificate Manager, the component responsible for handling certificates and associated private keys used by WinCC Unified PC Runtime. The Certificate Manager stores key material without adequate protective controls, allowing a local user to read sensitive cryptographic data that should remain confidential.

WinCC Unified PC Runtime is deployed on operator workstations in industrial control system (ICS) environments. Recovered key material can be used to impersonate legitimate runtime components, decrypt intercepted communications, or pivot deeper into operational technology (OT) networks.

Root Cause

The root cause is classified as [CWE-313], insufficient protection of cryptographic key material at rest. The Certificate Manager does not apply sufficient access control or encryption to the storage location holding the keys. Any local actor able to read the relevant files or process memory can extract the material in a usable form.

Attack Vector

Exploitation requires local access to the system running WinCC Unified PC Runtime. The attack does not require user interaction or prior authentication to the WinCC application itself, but the attacker must already have a foothold on the host. Successful exploitation yields confidentiality impact extending beyond the vulnerable component, since the recovered keys protect downstream subsystems.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploitation mechanism is described in the Siemens Security Advisory SSA-063511.

Detection Methods for CVE-2026-24349

Indicators of Compromise

Unexpected file reads against WinCC Certificate Manager storage directories by non-WinCC processes.
Use of credential-dumping or file-copy utilities executed on HMI operator workstations.
Outbound connections from systems presenting WinCC certificates that originate from hosts other than the registered runtime.

Detection Strategies

Monitor process access to Certificate Manager configuration paths and flag reads by interactive users or non-Siemens binaries.
Audit local logon events on WinCC Unified PC Runtime hosts and correlate with file-access telemetry from the same session.
Inspect endpoint telemetry for archive utilities, scripting hosts, or USB exfiltration activity following local logon to HMI workstations.

Monitoring Recommendations

Enable Windows object access auditing on directories used by WinCC Certificate Manager to capture read operations.
Forward host and application logs from HMI workstations to a centralized SIEM for correlation across OT and IT.
Track certificate use across the WinCC environment and alert on certificates presented from unexpected endpoints.

How to Mitigate CVE-2026-24349

Immediate Actions Required

Update SIMATIC WinCC Unified PC Runtime V21 to Update 2 or later as provided by Siemens.
For V16 through V20, follow the operational guidance in Siemens Security Advisory SSA-063511, since no fixed version is currently available for those branches.
Restrict interactive and remote local logon on WinCC hosts to a minimal, vetted set of administrators.

Patch Information

Siemens addresses the issue in SIMATIC WinCC Unified PC Runtime V21 Update 2. Earlier branches (V16 through V20) remain affected at the time of publication and require compensating controls per the vendor advisory. Refer to Siemens Security Advisory SSA-063511 for the authoritative remediation matrix.

Workarounds

Apply the Siemens defense-in-depth recommendations for industrial security, including network segmentation that isolates HMI workstations from general-purpose IT networks.
Enforce least-privilege access on the operating system hosting WinCC Unified PC Runtime and remove unnecessary local accounts.
Use full-disk encryption and physical access controls on operator workstations to limit offline extraction of key material.
Rotate certificates and keys managed by the WinCC Certificate Manager after patching, assuming prior exposure.

bash

# Configuration example: restrict access to WinCC Certificate Manager storage on Windows
# Run from an elevated PowerShell prompt; adjust the path to match the local installation.

$certPath = "C:\ProgramData\Siemens\WinCCUnified\CertificateManager"

# Remove inherited permissions and grant access only to SYSTEM and the WinCC service account
icacls $certPath /inheritance:r
icacls $certPath /grant:r "SYSTEM:(OI)(CI)F"
icacls $certPath /grant:r "NT SERVICE\WinCCUnifiedRuntime:(OI)(CI)F"
icacls $certPath /remove "Users" "Authenticated Users"

# Enable object access auditing for read events
auditpol /set /subcategory:"File System" /success:enable /failure:enable