Advisories

Siemens Capital Embedded AR Classic

The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Capital Embedded AR Classic are affected: Capital Embedded AR Classic 431-422 vers:all/* (CVE-2026-89208) Capital Embed

Read at CISA Cybersecurity Advisories

Vendor

Siemens

Product

SIMATIC / RUGGEDCOM / SINEC / SCALANCE / WinCC / TIA Portal

CVSS v3.1

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.003 (p18)

Fix

not yet available

Exposure class

OT / ICS

• CISA Cybersecurity Advisories (cisa.gov)
• CVE-2026-89208 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 32
   ICS advisory CISA 9d ago

   Siemens APOGEE, TALON and Desigo PXC/PXM Products

   CVSS 3.1 Fix available CVE-2026-102073CVE-2026-102074CVE-2026-102075+2 more Siemens
2. 20
   CVE NVD 18d ago

   A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303)…

   CVSS 5.3 CVE-2026-89208 Siemens