Anyone running Siemens Industrial Edge Device Kit, on either arm64 or x86-64 chips, anywhere from V1.5 to V1.28 is affected by two path traversal flaws. Only the three newest branches have a fix.
The bugs are tracked as CVE-2026-44414 and CVE-2026-44415. Path traversal means coaxing software into reaching files or internal routes outside what it is meant to expose. According to the advisory, affected systems do not properly restrict authenticated users' access to internal APIs and paths. An authenticated remote attacker could read sensitive internal information, which in the worst case could help them gain unauthorized access to the system. The advisory lists a CVSS v3 score of 9.1 out of 10, the scale's critical band.
The fixes are V1.26.2-1, V1.27.1-1 and V1.28.0-6, or any later version. The entries visible for older versions, including V1.10 and V1.19 through V1.25 on arm64, say no fix is planned. For every affected version, Siemens recommends limiting network access to trusted parties only. Across both architectures the advisory counts 48 affected products.
The score looks scarier than the precondition. The attacker needs valid credentials, so exposure depends on how tightly those logins and the network around them are controlled. That is the very mitigation Siemens leans on for the unpatched versions.
The awkward part is the gap between old and new. Industrial equipment tends to stay in service for years, and the advisory's background lists critical manufacturing, energy, healthcare and transportation among the affected sectors. For operators on pre-1.26 versions, the realistic choices are an upgrade to a fixed branch or a network lockdown. The advisory does not say how many deployments sit on the older lines, and that number decides how much of this is a routine patch cycle and how much is a migration project.