Owners of several Siemens SIMATIC industrial PCs should update their BIOS: a test key left in the Secure Boot database lets an attacker boot software the machine should reject.
Siemens' advisory, dated October 13 and republished by US authorities on October 22, covers CVE-2026-72895. Three groups of devices are affected: the IPC BX-21A (below V31.01.13), the IPC RW-543A (below V1.1.4), and five models, the IPC227G, IPC277G, IPC277G PRO, IPC327G and IPC377G (below V28.01.15). Siemens has released fixed versions for all of them.
Secure Boot works by checking that whatever loads at startup is signed by a key the machine trusts. Here, the trusted list includes a BIOS vendor's test key. Anything signed with it, whether an operating system or a UEFI application, will pass the check even with Secure Boot on. The advisory says that could mean a full loss of confidentiality, integrity and availability of the device. It scores 7.7 out of 10 (High) and is filed under CWE-1394, use of a default cryptographic key.
The score is held down by the attack path. The attacker needs local access, either physical or administrative, and the advisory's scoring rates the attack complexity as high. That puts the risk on the shop floor and in the cabinet, not on the internet. The advisory lists exposure across critical manufacturing, transportation, energy, healthcare, financial services and government facilities.
The update is not a simple install. After flashing the fixed BIOS, users must load the default settings and, if Secure Boot keys were already provisioned, provision them again. As a stopgap, administrators can delete the test key by hand, named "DO NOT TRUST - AMI Test PK" on the RW-543A and "insyde-ElkhartLake" on the others. On an unpatched machine, loading defaults restores it, so the order of operations matters.
That makes this a maintenance-window problem more than a panic. A trust list is only as strong as its least careful entry, and the cleanup here has to be done device by device.