CVE-2026-58113: Siemens Teamcenter XSS Vulnerability

CVE-2026-58113 Overview

CVE-2026-58113 is a reflected cross-site scripting (XSS) vulnerability in Siemens Teamcenter, a product lifecycle management (PLM) platform. The flaw resides in the /auth/ authentication redirect endpoint, which fails to properly encode user-supplied input reflected into HTML attribute contexts. An unauthenticated remote attacker can craft a malicious URL that, when loaded by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The attacker can then perform actions within the victim's Teamcenter session, including data access and manipulation constrained by the victim's permissions.

Critical Impact
Unauthenticated attackers can hijack authenticated Teamcenter sessions through crafted URLs, enabling arbitrary actions against PLM data with the victim's privileges.

Affected Products

Siemens Teamcenter V2412 (all versions prior to V2412.0013)
Siemens Teamcenter V2506 (all versions prior to V2506.0010)
Siemens Teamcenter V2512 (all versions prior to V2512.2607) and V2606 (all versions prior to V2606.2607)

Discovery Timeline

2026-09-08 - CVE-2026-58113 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-58113

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw [CWE-79] in the Teamcenter authentication redirect flow. The /auth/ endpoint accepts user-controlled parameters and reflects them into HTML attribute contexts without proper output encoding. When a browser parses the response, attacker-supplied content breaks out of the intended attribute and executes as JavaScript. Because the endpoint is part of the authentication path, it is reachable without prior authentication, lowering the barrier for exploitation.

Successful exploitation runs script in the origin of the Teamcenter web application. This grants the attacker access to session cookies, CSRF tokens, and any authenticated API the user can reach. Consequences include exfiltration of PLM engineering data, unauthorized configuration changes, and pivoting to other users through internally shared links.

Root Cause

The root cause is missing or insufficient contextual output encoding when user input is embedded in HTML attribute values within the /auth/ redirect handler. Encoding suitable for HTML element content does not neutralize attribute-context injection vectors such as attribute delimiter breakouts and event handler injection, and the affected code paths do not apply attribute-safe encoding.

Attack Vector

Exploitation requires an authenticated Teamcenter user to load an attacker-crafted URL, typically delivered by phishing, chat, or a compromised web page. The attacker does not need credentials, and the network attack vector is the standard HTTPS interface of the Teamcenter web tier. Once the victim's browser renders the response, the injected script executes with the origin's privileges and can issue requests to Teamcenter APIs as the victim.

No verified proof-of-concept code is available for this issue. Refer to the Siemens Security Advisory SSA-157465 for vendor-provided technical detail.

Detection Methods for CVE-2026-58113

Indicators of Compromise

HTTP requests to the /auth/ endpoint containing script markers, event handler attributes (onerror=, onload=, onmouseover=), or attribute-breakout characters such as unescaped quotes and angle brackets in query parameters.
Web server or reverse proxy logs showing unusually long or URL-encoded parameter values in authentication redirect requests originating from external referrers.
Outbound requests from user browsers to unfamiliar domains immediately after loading a Teamcenter /auth/ URL, indicating possible token or cookie exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to the Teamcenter /auth/ path for reflected XSS payload patterns and known JavaScript execution primitives.
Correlate authentication endpoint access with subsequent anomalous API calls from the same session, such as bulk data reads or permission changes shortly after redirect activity.
Enable Content Security Policy (CSP) violation reporting on the Teamcenter application and treat report bursts as high-priority triage events.

Monitoring Recommendations

Ingest Teamcenter web tier access logs and CSP reports into a centralized analytics platform for retention and cross-source correlation.
Alert on repeated /auth/ requests from the same source containing HTML metacharacters or encoded script fragments.
Track user session behavior for post-redirect anomalies, including new client IPs, user-agent changes, and off-hours PLM data access.

How to Mitigate CVE-2026-58113

Immediate Actions Required

Upgrade Teamcenter to a fixed version: V2412.0013 or later, V2506.0010 or later, V2512.2607 or later, or V2606.2607 or later.
Restrict access to the Teamcenter web tier to trusted networks or VPN users until patching is complete.
Notify Teamcenter users to avoid clicking Teamcenter authentication links received from untrusted sources.

Patch Information

Siemens has released fixed builds addressing the reflected XSS in the /auth/ endpoint. Consult the Siemens Security Advisory SSA-157465 for the authoritative patch matrix and download locations. Apply the update in a maintenance window and validate authentication flows after upgrade.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on Teamcenter responses.
Deploy WAF signatures that block requests to /auth/ containing attribute-breakout characters and JavaScript event handler names.
Require reauthentication for sensitive PLM actions and shorten session lifetimes to limit the value of a hijacked session.

bash

# Example WAF rule concept (ModSecurity-style) to block XSS payloads on the auth endpoint
SecRule REQUEST_URI "@beginsWith /auth/" \
  "phase:2,deny,status:403,id:1005811,\
   msg:'Potential reflected XSS in Teamcenter /auth/ endpoint',\
   chain"
SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:|\"\s*on\w+\s*=)" \
  "t:none,t:urlDecodeUni"