CISA 2026-10-22

Siemens PSS(R)SINCAL

CVE-2026-84854

Machine-generated analysis · WAYSCloud LLM

The WibuKey driver used by Siemens PSS(R)SINCAL can cause an out-of-bounds write leading to a system crash when the legacy dongle license is configured.

Context

Siemens PSS(R)SINCAL is a software product that can be configured to use a legacy WibuKey dongle license. The advisory states that the WibuKey driver contains an out-of-bounds write vulnerability (CVE-2026-84854) that may cause a system crash, resulting in a denial-of-service condition. Siemens is preparing updates and recommends installing the WibuKey Runtime version 6.72 or later as a mitigation until a patch is released.

Operator considerations

Check which PSS(R)SINCAL installations are using the legacy WibuKey dongle license.
Patch: Install WIBU Systems WibuKey Runtime for Windows version 6.72 or later on affected systems.
Log: Monitor system logs for unexpected crashes or kernel errors that could indicate exploitation.

From Cybersecurity and Infrastructure Security Agency ↗

PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.

The following versions of Siemens PSS(R)SINCAL are affected:

PSS(R)SINCAL V21.5 vers:all/* (CVE-2026-84854)

PSS(R)SINCAL V22.0 vers:all/* (CVE-2026-84854)

PSS(R)SINCAL V22.5 vers:intdot/

Read the full advisory on CISA →