Anyone running Siemens Industrial Edge App Publisher below version 1.27.9 should update to 1.27.9 or later. The update fixes two flaws that, combined, let an attacker on the network run their own code on the machine hosting the software.
The first flaw, CVE-2026-78556, is that the software does not properly validate the server certificate when it opens a TLS connection. TLS is the encryption handshake that proves a client is talking to the right server. An attacker sitting between the Publisher and its management server can intercept the traffic and impersonate that server. It scores 7.4 out of 10 on CVSS, the standard severity scale.
The second, CVE-2026-78557, is that the application renders data from backend responses without escaping it. Because the front end is integrated with Node.js, injected JavaScript can reach the underlying machine and achieve remote code execution (RCE), meaning the attacker's code runs on the victim's computer. It scores 8.3. Its vector marks it as needing user interaction and as high complexity to pull off.
The pairing is what matters. The second bug needs a malicious backend response, and the first bug lets an attacker supply one by posing as the backend. Cross-site scripting normally stays inside a browser tab. Node.js integration is what turns it into a problem for the whole machine.
The preconditions limit the risk. Both flaws are rated high attack complexity, and the attacker needs a position on the network path. The advisory does not say either bug has been exploited. Still, Siemens lists the software as deployed worldwide, with affected sectors spanning critical manufacturing, energy, transportation, healthcare, financial services and government facilities.
Siemens ProductCERT reported the flaws to CISA. Siemens published its advisory, SSA-968435, on October 13. CISA republished it verbatim on October 22 and said it is not responsible for the advisory's accuracy.
The mitigation advice is the usual set: keep control systems off the internet, put them behind firewalls, and use updated VPNs for remote access. Here it targets the attack's main precondition. If an attacker cannot get onto the network path, the certificate flaw has nothing to exploit.