High Patch available CVSS up to 8.3
Siemens Industrial Edge App Publisher flaws could let a network attacker run code
CISA ICS AdvisoriesSiemens · Critical Manufacturing, Transportation Systems, EnergyCVE-2026-78556, CVE-2026-78557
What happened. Two flaws can be chained. An attacker on the network could impersonate the management server and run arbitrary code on the local machine. Siemens has released an update.
Who is affected. Users of Siemens Industrial Edge App Publisher versions before 1.27.9.
What to do. Check whether you run Industrial Edge App Publisher before 1.27.9, and update to the latest version Siemens has released.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: App Publisher is a desktop tool that packages and publishes apps to industrial edge devices and talks to a management server on the site network.
- Are you exposed?
Check engineering and developer workstations for Industrial Edge App Publisher installations below version 1.27.9.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Siemens Manufacturing Transport Energy and power CVE-2026-78556 CVE-2026-78557