Siemens has no patch planned for CVE-2026-89208, a flaw in building automation controllers, and tells customers to wall the devices off instead.
The advisory covers five vulnerabilities across Siemens APOGEE, TALON and Desigo PXC/PXM products. Four of them, CVE-2026-102073 through CVE-2026-102076, affect the APOGEE MBC (PPC) and MEC (PPC) controllers in both BACnet and P2 Ethernet variants, in all versions. The fifth, CVE-2026-89208, affects the APOGEE PXC Compact (BACnet), the TALON TC Compact (BACnet) and more than a dozen Desigo PXC and PXM models running version 2.3 or later.
The advisory says the flaws could let an attacker cause a denial of service and potentially hurt the availability of a device. One entry, CVE-2026-102073, is described more specifically: the web service does not properly check the length of user-controlled input, so an unauthenticated remote attacker could read portions of device memory or trigger a denial of service. Siemens said it has released new versions for several affected products and recommends updating. The advisory does not say which ones.
For the CVE-2026-89208 products, the listed remedy is a mitigation: apply network segmentation and put the controllers behind properly configured gateways or firewalls. The entries for the APOGEE MBC controllers add a second step, disabling the FTP/Web service, which the advisory notes is off by default on APOGEE, Desigo and TALON products.
That default matters. Exposure here likely depends on whether someone switched the service on, though the advisory does not spell that out. These controllers run heating, ventilation and air conditioning, and such hardware tends to stay in buildings far longer than office IT. A no-patch outcome is a common ending for that kind of gear, which leaves the network layout, not the firmware, as the real control.