CVE-2026-85114

Executive Summary

CVE-2026-85114 is a path traversal vulnerability (CWE-22) in the .NET Client Library for SIMATIC S7 Webserver API affecting all versions prior to V3.3.61. The library fails to properly validate filenames received from remote servers during ticket downloads, allowing an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and overwrite existing files accessible to the application. With a CVSS score of 7.5 (High), this vulnerability has no public exploit or patch currently available, and Siemens SIMATIC S7 deployments relying on the affected client library are exposed to integrity-compromising attacks.

Technical Analysis

The .NET Client Library for SIMATIC S7 Webserver API is a client-side component used by applications to interact with the SIMATIC S7 webserver API, including operations that involve downloading "tickets" from remote servers. According to the NVD description, the core flaw is a failure to properly validate filenames received from remote servers during these ticket downloads.

This constitutes a classic path traversal (directory traversal) vulnerability — CWE-22. The attack surface is the ticket download functionality of the client library. When the library receives a ticket response from a remote server, it processes a filename (or path component) supplied by that server. Because the library does not validate or sanitize this filename, a malicious or compromised remote server can supply a filename containing directory traversal sequences (for example, "../" sequences) or an absolute path. This causes the client application to write the downloaded file to a location outside the intended download directory.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates:

• Network attack vector (AV:N): the malicious input originates from a remote server over the network.
• Low attack complexity (AC:L): no special conditions are required beyond the attacker's ability to influence the ticket response.
• No privileges required (PR:N) and no user interaction (UI:N): the attacker does not need credentials and no victim must perform an explicit action.
• High integrity impact (I:H): the attacker can write and — when overwriting is enabled — replace files accessible to the application.
• No confidentiality or availability impact (C:N/A:N): the impact is limited to file integrity.

The vulnerability requires the attacker to control or manipulate the response from the remote server that the client library communicates with during ticket downloads. This can be achieved through a Man-in-the-Middle (MitM) position, DNS spoofing, a compromised remote endpoint, or any other means of intercepting and altering the ticket response.

No further code-level detail (specific function names, parameters, or file paths) is provided in the available NVD description. Per the CNA, the affected component is the ".NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61)".

Exploitation Scenarios

No public proof-of-concept (PoC), Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-22 path traversal) and the NVD description. No specific function names, endpoints, or parameters are invented.

1) Reconnaissance / target identification The attacker identifies a target environment where an application uses the .NET Client Library for SIMATIC S7 Webserver API (versions < V3.3.61) to download tickets from a remote server. This is typically an internal or industrial network where the client application communicates with a SIMATIC S7 webserver or a related remote endpoint that serves ticket downloads.

2) Triggering the flaw class The attacker must be positioned to manipulate the ticket response — for example, by acting as a Man-in-the-Middle, by controlling DNS resolution to a malicious or rogue server, or by compromising the legitimate remote server. When the affected client library processes the ticket response, it receives a filename that it fails to validate. The attacker crafts this filename to contain traversal sequences or an absolute path so that the file is written outside the intended download directory.

3) Payload / execution method at the vulnerability-class level The remote server's manipulated response delivers a crafted filename that, when combined with the download directory, resolves to an unintended destination path. Depending on the application's enabled write mode, the file may be placed at an arbitrary location the application can reach. Because overwriting is possible when enabled, the attacker can replace existing files accessible to the application. The vulnerability class is directory traversal resulting in arbitrary file write; no specific function or parameter names are available from the description to name here.

4) Post-exploitation impact Successfully exploiting the flaw yields unauthorized file writes and, where overwriting is enabled, replacement of existing files. This can lead to modification of application configuration, data files, or other resources the application can access, resulting in an integrity compromise. Since confidentiality and availability are not directly impacted per the CVSS vector, the primary concern is tampering with files that influence application behavior.

Impact Assessment

The vulnerability has a CVSS 3.1 base score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. Business impacts include:

• Integrity compromise (I:H): Arbitrary file write and, when overwriting is enabled, replacement of files accessible to the application. This can undermine trust in downloaded artifacts and any downstream logic that consumes them.
• No confidentiality or availability impact (C:N/A:N): The described impact is limited to integrity, though indirect operational effects may occur if critical files are overwritten.
• Affected systems: Any application or integration that uses the .NET Client Library for SIMATIC S7 Webserver API at versions below V3.3.61 to download tickets from remote servers, particularly in industrial control and OT environments where SIMATIC S7 systems are deployed.
• Blast radius: The scope depends on the privileges and reachable file paths of the application hosting the client library. An attacker who can also influence the remote server response increases the exposure. Because no privileges or user interaction are required (PR:N/UI:N), the barrier is low once network manipulation is possible.

No evidence of CISA KEV listing, public exploit code, or in-the-wild exploitation was provided; the EPSS score has not yet been assigned by FIRST.org.

Detection Guidance

Sigma Rule

title: Potential Path Traversal File Write via SIMATIC S7 Webserver API Client Library
id: 4f8c2a1e-9b7d-4c3e-8a21-6e5d0f9a7c10
status: experimental
description: Detects file write events with traversal sequences in the target path that may indicate exploitation of CVE-2026-85114 in the .NET Client Library for SIMATIC S7 Webserver API.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85114
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.85114
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\..\..\'
      - '/../../'
      - '..\\..\\'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
  selection_extension:
    TargetFilename|endswith:
      - '.dll'
      - '.exe'
      - '.config'
      - '.xml'
      - '.json'
  condition: selection_path and selection_extension
falsepositives:
  - Legitimate applications writing paths containing literal '..' sequences (rare)
level: high

YARA Rule

rule CVE_2026_85114_PathTraversal_TicketResponse
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects traversal sequences in captured ticket response data associated with CVE-2026-85114"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85114"
        date = "2026-01-01"
        cve = "CVE-2026-85114"

    strings:
        $traversal_win = "..\\..\\" ascii wide
        $traversal_unix = "../../" ascii wide
        $ticket = "ticket" ascii nocase wide
        $download = "download" ascii nocase wide
        $filename = "filename" ascii nocase wide

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x04034b50) and
        ($traversal_win or $traversal_unix) and
        ($ticket or $download or $filename)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85114 SIMATIC S7 Webserver API Client Path Traversal in Ticket Response"; flow:established,to_client; http.header; content:"Content-Disposition"; nocase; http.header; content:"filename="; nocase; http.header; pcre:"/filename\s*=\s*[\"']?(?:\.\.[\/\\])+/i"; reference:cve,2026-85114; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85114; classtype:attempted-user; sid:202685114; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

file where event.action in ("creation", "modification", "rename") and
  wildcard(file.path, "*..*") and
  process.name : "*.exe"

Splunk SPL Query

index=endpoint OR index=file_event (EventCode=11 OR action=file_created OR action=file_modified)
| search (TargetFilename="*..\\..*" OR TargetFilename="*/../*" OR TargetFilename="*%2e%2e%2f*" OR TargetFilename="*%2e%2e%5c*")
| eval risk_score=case(match(TargetFilename,"\.(dll|exe|config|xml|json)$"), "high", true(), "medium")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files by host, Image, risk_score
| where risk_score="high"
| sort - count

Wazuh OSSEC Rule

<group name="simatic_s7,cve_2026_85114,">
  <rule id="100851" level="12">
    <if_sid>550</if_sid>
    <field name="file">\.\.|%2e%2e</field>
    <description>CVE-2026-85114: Possible path traversal file write by SIMATIC S7 Webserver API client library</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85114,integrity_violation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict network paths so that the client library only communicates with trusted, authenticated remote servers over mutually authenticated TLS; this reduces the attacker's ability to manipulate the ticket response.
• Disable file overwriting where the application permits such a configuration, per the NVD note that replacement of existing files is possible "when overwriting is enabled."
• Run the application hosting the affected client library with the least privileges necessary, and constrain its filesystem write access to the minimum required directories.
• Monitor for file write events containing traversal sequences in the target path (see Detection Guidance).

2) Patch / upgrade steps

• No patch is currently available. The CNA identifies affected versions as all versions below V3.3.61, implying V3.3.61 or later as the intended fixed version. Confirm availability of V3.3.61+ directly with Siemens and upgrade as soon as it is released.
• Track the Siemens ProductCERT advisory and the NVD entry for updates, since no vendor fix reference is available at this time.

3) Long-term hardening

• Enforce strict filename and path validation (allowlisting, canonicalization and confinement to the intended download directory) in any client that consumes remote-supplied filenames — the missing control at the heart of CWE-22.
• Adopt signed ticket responses or integrity verification so that altered responses from a man-in-the-middle are rejected.
• Apply network segmentation between OT/SIMATIC environments and general IT networks, and use TLS interception/inspection to detect anomalous download responses.
• Maintain an inventory of applications embedding the .NET Client Library for SIMATIC S7 Webserver API and their versions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85114
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') — https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• Siemens ProductCERT advisories — https://www.siemens.com/cert/
• FIRST EPSS: no score currently assigned for CVE-2026-85114 (https://api.first.org/data/v1/epss?cve=CVE-2026-85114)

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV listing were provided or identified for this CVE.