CVE-2026-44415 is a critical (CVSS 9.1) access control flaw in Siemens Industrial Edge Device Kit for arm64. Authenticated remote attackers can reach internal APIs and paths and expose sensitive internal information.
What Is It
Siemens reports that affected systems "do not properly restrict access to internal APIs and paths for authenticated users." An authenticated remote attacker could use this to read sensitive internal information. In the worst case, that information could help the attacker gain unauthorized access to the system or delete data.
Siemens ProductCERT published the CVE on 2026-10-13. Its NVD status is currently "Received," which means NVD has not yet analyzed the record or published its own score.
Why It Matters
Siemens ProductCERT, the CVE Numbering Authority (CNA) for this flaw, scores it 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. NVD shows this CNA score but has not yet given its own assessment. That vector means:
- Network-exploitable with low attack complexity and no user interaction.
- High privileges required. The attacker must already be authenticated with elevated access, which limits who can exploit it.
- Scope changed. Impact can extend beyond the vulnerable component.
- High impact to confidentiality, integrity and availability.
Industrial Edge devices sit between operational technology and IT networks, so a compromise here deserves attention.
KEV status: As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. That means CISA has not confirmed active exploitation.
What's Vulnerable
All affected products are Siemens Industrial Edge Device Kit - arm64, across these version lines:
- V1.5 through V1.25: all versions affected, with no fixed version listed
- V1.26: versions before V1.26.2-1
- V1.27: versions before V1.27.1-1
- V1.28: versions before V1.28.0-6
The NVD record does not list any example CPEs.
Patch Status
The NVD record lists fixed versions for three version lines:
- V1.26 → update to V1.26.2-1 or later
- V1.27 → update to V1.27.1-1 or later
- V1.28 → update to V1.28.0-6 or later
The record lists no fixed version for V1.5 through V1.25. Operators on those lines should read the Siemens advisories below for remediation or mitigation guidance. Moving to a fixed release line is the likely path.
CISA has issued no required action, because the CVE is not in the KEV catalog as of publication.