CVE-2026-24349: simatic wincc unified pc runtime 21; +6 more affected products

Affected technology

simatic wincc unified pc runtime · from 16 (inclusive), through 20 (inclusive)
siemens

simatic wincc unified pc runtime · 21
siemens

simatic wincc unified pc runtime · 21 · update update1
siemens

SIMATIC WinCC Unified PC Runtime V16 · 0 to before *
Siemens

SIMATIC WinCC Unified PC Runtime V17 · 0 to before *
Siemens

SIMATIC WinCC Unified PC Runtime V18 · 0 to before *
Siemens

SIMATIC WinCC Unified PC Runtime V19 · 0 to before *
Siemens

SIMATIC WinCC Unified PC Runtime V20 · 0 to before *
Siemens

SIMATIC WinCC Unified PC Runtime V21 · 0 to before V21 Update 2
Siemens

Description’s affected range: versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.