CISA 2026-09-22

Siemens SIPLUS and SIMATIC Products

CVE-2026-31431 +6

Machine-generated analysis · WAYSCloud LLM

Multiple Siemens SIPLUS and SIMATIC products are listed as vulnerable to CVE-2026-31431. Siemens has released newer software versions and advises updating to the latest releases.

Context

The advisory covers Siemens SIPLUS and SIMATIC offerings, including SIMATIC AX Runtime Core Linux (Debian) and a range of SIMATIC HMI MTP1000 and MTP1200 panels. These versions are vulnerable to the "Copy Fail" vulnerability (CVE-2026-31431), and Siemens recommends updating to the latest available versions. For products without an immediate fix, Siemens advises applying specific countermeasures while additional fix versions are prepared.

Operator considerations

Check: inventory installed versions of the listed SIMATIC AX Runtime Core Linux and HMI MTP models to identify any that are below the advised version thresholds.
Isolate: segment or restrict network access to vulnerable HMI panels that cannot be updated immediately, following Siemens' countermeasure guidance.
Patch: apply the newly released Siemens software updates for affected products where they are available.
Log: monitor system logs for copy-operation failures or related error messages that could indicate exploitation attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens SIPLUS and SIMATIC Products are affected:

SIMATIC AX Runtime Core Linux Common Debian vers:all/* (CVE-2026-31431)

SIMATIC AX Runtime Core Linux Common Debian arm64 vers:all/* (CVE-2026-31431)

SIMATIC AX Runtime Core Linux Platform Container Common Debian Development vers:all/* (CVE-2026-31431)

SIMATIC AX Runtime Core Linux VMWare Development vers:all/* (CVE-2026-31431)

SIMATIC CN 4100 vers:intdot/

Read the full advisory on CISA →