CVE-2026-58113

Executive Summary

CVE-2026-58113 is a reflected cross-site scripting (XSS) vulnerability in Siemens Teamcenter, a widely deployed Product Lifecycle Management (PLM) platform. The flaw resides in the authentication redirect flow, where user-supplied input is improperly encoded before being reflected into HTML attribute contexts within the /auth/ endpoint. An unauthenticated remote attacker can craft a malicious URL that, when loaded by an authenticated user, executes arbitrary JavaScript within the victim's Teamcenter session context.

The vulnerability affects four Teamcenter release trains: V2412 (all versions prior to V2412.0013), V2506 (prior to V2506.0010), V2512 (prior to V2512.2607), and V2606 (prior to V2606.2607). With a CVSS score of 6.1 (Medium), the attack requires user interaction but no privileges or prior authentication. Successful exploitation enables session hijacking, unauthorized actions within the PLM environment, and potential data exfiltration of sensitive engineering and manufacturing data. As of this report, no patch is confirmed available from any tracked source, and no public exploit code exists.

Technical Analysis

Vulnerability Class and Mechanism

CVE-2026-58113 belongs to the CWE-79 class — Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). Specifically, this is a reflected XSS vulnerability confined to the authentication redirect flow of the Teamcenter web interface.

The root cause is a failure to properly encode user-supplied input before it is reflected into an HTML attribute context. HTML attribute contexts are distinct from text node contexts and require different encoding strategies. For example, input placed inside a value="..." attribute is still vulnerable to JavaScript execution if the attacker can close the attribute and inject an event handler (e.g., onmouseover, onerror) or a javascript: URI scheme. The NVD description explicitly notes that input is "reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint)."

Attack Surface

The affected component is the /auth/ endpoint within the Teamcenter web application. This endpoint appears to handle authentication redirects, likely processing parameters that determine post-login destination URLs or authentication state. Because Teamcenter is deployed as an enterprise web application accessible over HTTP/HTTPS, the endpoint is network-exposed. The nature of the issue — improper encoding in redirect logic — suggests that query parameters, path segments, or form fields processed by this endpoint are echoed back into the HTML response before or during the authentication sequence.

Technical Severity Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates:

• Attack Vector: Network — exploitable remotely
• Attack Complexity: Low — no special conditions required
• Privileges Required: None — unauthenticated attacker
• User Interaction: Required — victim must click or load a crafted URL
• Scope: Changed — compromise impacts resources beyond the vulnerable component (e.g., victim's entire session)
• Confidentiality Impact: Low — limited data disclosure
• Integrity Impact: Low — limited modification of data/actions
• Availability Impact: None

The Changed scope is important: successful exploitation crosses a trust boundary, allowing the attacker to operate within the authenticated session of the victim, potentially with elevated privileges relative to the unauthenticated state.

Insufficient Technical Detail

The NVD description does not specify which query parameter, cookie, or header is vulnerable, nor does it name the specific CGI script or framework function responsible for the insecure reflection. Insufficient technical detail is available regarding the exact injection point within the /auth/ endpoint. Attackers will likely perform black-box testing against the authentication flow to identify the reflection point. No source code or patch diff is publicly available to validate the precise mechanism.

Exploitation Scenarios

Attack Chain Overview

No public PoC, exploit code, or Nuclei template is available. The following attack chain is inferred from the vulnerability class (reflected XSS in an authentication redirect) and the NVD description.

Step 1: Reconnaissance / Target Identification The attacker identifies an exposed Teamcenter instance. Discovery methods include Shodan/Censys searching for Teamcenter-related banners and titles, or scanning known IP ranges of target organizations in the manufacturing, automotive, aerospace, or defense sectors. The attacker confirms the Teamcenter version by inspecting the login page source, identifiable URL patterns, or version-specific static resources.

Step 2: Triggering the Flaw The attacker constructs a malicious URL targeting the /auth/ endpoint. Since the flaw involves improper encoding of user input reflected into HTML attributes, the attacker injects a payload designed to break out of the attribute context. A typical payload would include characters such as " or ' to close the attribute, followed by an event handler attribute (e.g., onfocus) or a javascript: pseudo-URL. The attacker appends this payload to a parameter that the /auth/ endpoint reflects in its response. This malicious URL is then delivered to a victim via phishing emails, instant messaging, or by embedding it in a compromised third-party page that Teamcenter users are likely to visit.

Step 3: Payload Execution The victim, who must be an authenticated Teamcenter user, clicks the crafted link. The browser sends the request to the /auth/ endpoint, and the server responds with an HTML page that reflects the unsanitized payload within an HTML attribute. The browser parses this response and executes the injected JavaScript in the context of the Teamcenter origin, inheriting the victim's session cookies and authentication tokens.

Step 4: Post-Exploitation Impact With arbitrary JavaScript execution in the victim's session context, the attacker can:

• Read and exfiltrate sensitive data displayed on the page, including product designs, BOMs, and project documentation
• Perform state-changing actions through AJAX requests to legitimate Teamcenter APIs — e.g., modifying data, changing user permissions, or initiating workflows
• Steal session cookies for full session hijacking, allowing persistent unauthorized access
• Deface the Teamcenter UI or inject phishing forms to harvest credentials
• Leverage the authenticated platform to pivot deeper into the PLM data store

Because the CVSS scope is Changed, the injected script can perform actions beyond what the vulnerable endpoint itself would permit, effectively using the victim's session as a proxy.

Impact Assessment

Business Impact

Teamcenter is Siemens' flagship PLM platform, used by engineering, manufacturing, and quality teams across automotive, aerospace, defense, high-tech, and industrial machinery sectors. The platform contains highly sensitive intellectual property — CAD models, engineering specifications, bill of materials, change orders, and compliance records. A successful XSS exploitation could result in:

• Data exfiltration: Theft of proprietary designs or engineering data, potentially worth millions of dollars in R&D
• Integrity compromise: Unauthorized modification of product data, which could propagate defective designs downstream
• Regulatory and legal exposure: Breach of contracts requiring protection of customer-owned data
• Operational disruption: Injected scripts could halt workflows, corrupt records, or lock out administrators

Affected Systems

All deployments of Teamcenter V2412 (before V2412.0013), V2506 (before V2506.0010), V2512 (before V2512.2607), and V2606 (before V2606.2607) are potentially vulnerable. Organizations with external access to Teamcenter — either for remote employees, customer portals, or supplier collaboration — face the highest risk.

Blast Radius

The CVSS subscores reflect a Medium severity (6.1) with Changed scope. The attacker needs to lure a legitimate authenticated user into clicking a crafted link. In enterprise environments, the user interaction requirement mitigates the likelihood of large-scale automated exploitation. However, because Teamcenter often integrates with other enterprise systems (ERP, MES, CAD tools), the lateral impact of compromised session credentials could extend beyond Teamcenter itself.

Detection Guidance

The following detection rules are designed to flag attempts to exploit reflected XSS in authentication endpoints. They are generic in nature, tuned to the described vulnerability class, and should be fine-tuned for the specific environment.

Sigma Rule

title: Reflected XSS Attempt Against Authentication Endpoint (CVE-2026-58113)
id: c1a2b3d4-0001-4e5f-9a6b-7c8d9e0f1a2b
status: experimental
description: Detects HTTP requests to authentication-related endpoints (e.g., /auth/) containing common XSS payload patterns indicating attempted script injection.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58113
author: Valtersit Threat Intelligence
date: 2026/02/14
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.58113
logsource:
    category: webserver
    product: generic
detection:
    selection_path:
        cs-method: GET
        cs-uri-path|contains:
            - /auth/
    selection_payload:
        cs-uri-query|contains:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'onclick='
            - 'onmouseover='
            - '%3Cscript'
            - '%3C/script%3E'
            - '&#x3C;'
            - '\\u003c'
    condition: selection_path and selection_payload
    timeframe: 5m
fields:
    - clientip
    - cs-uri-query
    - user-agent
falsepositives:
    - Legitimate URL encoding of these strings in non-vulnerable parameters
    - Security scanners performing benign checks (will also catch signature)
level: medium

YARA Rule

rule CVE_2026_58113_Reflected_XSS_Teamcenter
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-02-14"
        description = "Detects web server logs or packet captures containing XSS payload indicators targeting authentication redirect endpoints, indicative of CVE-2026-58113 exploitation attempts."
        cve = "CVE-2026-58113"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-58113"

    strings:
        // Common XSS payload fragments that might appear in reflected GET/POST data
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "javascript:alert" ascii wide nocase
        $xss3 = "onerror=" ascii wide nocase
        $xss4 = "onload=" ascii wide nocase
        $xss5 = "onclick=" ascii wide nocase
        $xss6 = "onmouseover=" ascii wide nocase
        $xss7 = "&lt;script&gt;" ascii wide nocase
        $xss8 = "%3Cscript%3E" ascii wide nocase
        $xss9 = "prompt(" ascii wide nocase
        $xss10 = "document.cookie" ascii wide nocase
        $xss11 = "fetch(" ascii wide nocase
        $xss12 = "XMLHttpRequest" ascii wide nocase

        // Authentication endpoint paths
        $auth = "/auth/" ascii wide nocase
        $auth2 = "auth/redirect" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 10MB
        and (1 of ($xss*)) and (1 of ($auth*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-58113 Teamcenter Reflected XSS in /auth/ Endpoint - Attempted Exploitation"; flow:established,to_server; http.uri; content:"/auth/"; http.uri; pcre:"/(?:%3C|%3c|\\x3c|<)(?:script|img|svg|iframe|body|input|textarea)/i"; http.uri; pcre:"/(?:javascript\s*:|on(?:error|load|click|mouseover|focus|blur)\s*=)/i"; classtype:web-application-attack; reference:cve,2026-58113; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-58113; sid:202658113; rev:1; metadata:created_at 2026_02_14, updated_at 2026_02_14;)

Elastic Detection

// EQL query to detect XSS probing attempts against authentication endpoints
sequence by source.ip
  [network where process.name == "httpd" and
   url.path contains "/auth/" and
   (url.query contains "<script" or
    url.query contains "%3Cscript%3E" or
    url.query contains "javascript:" or
    url.query contains "onerror=" or
    url.query contains "onload=" or
    url.query contains "onclick=" or
    url.query contains "onmouseover=" or
    url.query contains "&lt;script&gt;")]
  [network where process.name == "httpd" and
   url.path contains "/auth" and
   http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis OR sourcetype=apache
| where uri_path LIKE "%/auth/%"
| search uri_query IN ("*<script*", "*%3Cscript%3E*", "*javascript:on*", "*onerror=*", "*onload=*", "*onclick=*", "*onmouseover=*", "*&lt;script&gt;*", "*prompt(*", "*document.cookie*")
| eval attack_type = case(
    uri_query LIKE "%<script%" OR uri_query LIKE "%3Cscript%3E" OR uri_query LIKE "%&lt;script&gt;" OR uri_query LIKE "%\\u003c%" , "Script tag injection",
    uri_query LIKE "%javascript:%" OR uri_query LIKE "%onerror=%" OR uri_query LIKE "%onload=%" OR uri_query LIKE "%onclick=%" OR uri_query LIKE "%onmouseover=%", "Event handler / javascript URI injection",
    true, "Generic XSS payload")
| stats count by src_ip, uri_path, uri_query, attack_type, user_agent
| where count >= 1
| sort - count
| table _time, src_ip, uri_path, uri_query, attack_type, count, user_agent

Wazuh OSSEC Rule

<group name="web,xss,attacks,">

  <rule id="100581" level="10">
    <if_sid>31100</if_sid>  <!-- Generic web access log rule -->
    <regex>GET \S*\/auth\/\S*(&lt;script|%3Cscript|javascript:|onerror=|onload=|onclick=|onmouseover=|prompt\(|document\.cookie)</regex>
    <description>CVE-2026-58113: Possible XSS payload in authentication endpoint request (Teamcenter)</description>
    <group>attack,xss,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <url>https://nvd.nist.gov/vuln/detail/CVE-2026-58113</url>
  </rule>

  <rule id="100582" level="0">
    <if_sid>100581</if_sid>
    <regex>OPTIONS|HEAD</regex>
    <description>Excluding non-exploitable HEAD/OPTIONS requests from XSS alerting.</description>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source. The NVD description references fixed versions (V2412.0013, V2506.0010, V2512.2607, V2606.2607), implying Siemens is aware of required updates, but no vendor advisory, patch download, or release announcement has been confirmed.

1) Immediate Mitigations (until patch is available)

• Restrict network access to the Teamcenter web interface. Place it behind a VPN or zero-trust access layer. Block direct internet exposure of the /auth/ endpoint via perimeter firewall rules.
• Enforce web application firewalling: Deploy a WAF with rules that block common reflected XSS payload patterns — script tags, event handler attributes (onerror=, onload=), and javascript: URIs — in URI query strings targeting /auth/.
• Educate users on phishing risks: Instruct all Teamcenter users not to click links to the Teamcenter login URL directly from emails or untrusted sources. Advise manual navigation to the PLM portal. This mitigates the UI:R requirement.
• Monitor authentication logs for unusual multiple requests to /auth/ from single sources or with anomalous query strings.
• Browser-level hardening: For high-risk users, consider browser extensions blocking third-party requests or enforcing Content Security Policy (CSP) headers, if the application supports header injection via reverse proxy.

2) Patch / Upgrade Steps

• Monitor Siemens ProductCERT security advisories (https://cert-portal.siemens.com/productcert/) and the Siemens Industrial Control Systems security portal for a formal advisory referencing CVE-2026-58113.
• When the vendor releases the fixed versions (V2412.0013, V2506.0010, V2512.2607, V2606.2607), schedule an immediate upgrade in coordination with the PLM support team. Prior to upgrade, maintain current backups of the Teamcenter database and file storage.
• Upgrade all components of the Teamcenter stack, including the web tier and any intermediary load balancers or proxies, to ensure consistent behavior.

3) Long-Term Hardening

• Input validation: Implement a centralized input-handling library across all Teamcenter web endpoints to ensure context-aware output encoding (HTML entity, attribute, JavaScript, and URL encoding as appropriate).
• Content Security Policy: Configure the Teamcenter web server to emit strict CSP headers (default-src 'self'; script-src 'self') to mitigate impact of any residual XSS.
• HttpOnly and Secure cookie flags: If not already set, mark all authentication cookies HttpOnly and Secure to reduce the value of stolen cookies.
• Security testing integration: Incorporate reflected XSS checks into CI/CD pipelines and conduct periodic external and internal penetration tests focused on the authentication and redirect flows.
• Vulnerability scanning: Subscribe to Siemens advisory RSS feeds and CVSS feeds to receive immediate alerts on newly disclosed Teamcenter vulnerabilities.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-58113
2. Siemens ProductCERT — https://cert-portal.siemens.com/productcert/ (Monitor for upcoming advisory referencing fixed versions V2412.0013, V2506.0010, V2512.2607, V2606.2607)
3. CWE-79 Details (MITRE) — https://cwe.mitre.org/data/definitions/79.html
4. CVSS Calculator (FIRST.org) v3.1 — https://www.first.org/cvss/calculator/3.1 (for vector verification)
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-58113 NOT currently listed)

Threat Actor Activity

As of the time of this report, no public evidence exists of exploitation in the wild, no exploit code has been published, and no known threat actor campaigns reference CVE-2026-58113. The vulnerability should be treated with elevated urgency given the sensitivity of data handled by Teamcenter and the unpatched status, but the lack of UI-independent exploitability currently reduces the risk of automated mass exploitation. High-value targets in the defense, automotive, and aerospace supply chain should remain vigilant given the historical interest of APT groups in PLM systems.