Siemens has patched a high-severity flaw that let anyone with network access to its fleet-management software read files off the underlying server without logging in.
Siemens ProductCERT disclosed the vulnerability on September 8, 2026, and CISA republished the advisory two weeks later, on September 22. The bug, tracked as CVE-2026-67367, sits in the embedded HTTP server of SIMOVE Fleetmanager and SIPLANT, industrial software used to plan and manage vehicle and production fleets. It fails to strip directory-traversal sequences from file requests, so an unauthenticated remote attacker could walk outside the intended file scope and pull data like credential stores, private keys, and configuration secrets. CVSS scored it 8.6, and it affects SIMOVE Fleetmanager versions before 3.1.13, 3.2.4, 3.3.2, and 4.0.1, plus SIPLANT 1.7, 2.2, 3.0, and versions before 3.1.4. Siemens has shipped fixed builds for most of the lineup, though some SIPLANT versions require contacting customer support directly since there is no downloadable patch.
This is a plain old path-traversal bug, cataloged for decades as CWE-23, showing up in software that plans production and vehicle fleets for critical manufacturing operations worldwide. No authentication required, no user interaction needed - just network access to the device's web interface. That is the kind of low-effort, high-value target that gets scanned for the moment an advisory like this goes public.
The two-week gap between Siemens' original disclosure and CISA's republication is routine bureaucratic lag, not a cover-up, but it is still two extra weeks that unpatched systems sat exposed once the technical details were circulating.