Critical Authentication Bypass Vulnerability Found in Siemens Opcenter X
Siemens Opcenter X is affected by a critical authentication bypass vulnerability, CVE-2026-56451, allowing unauthenticated attackers to gain full unauthorized access.
Siemens has issued a security advisory for its Opcenter X software, detailing a critical vulnerability that could allow attackers to bypass authentication and gain complete unauthorized access to the application. The flaw, identified as CVE-2026-56451, affects all versions of Opcenter X prior to V2604.
The vulnerability stems from an improper validation of the algorithm specified in JSON Web Token (JWT) headers. JWTs are commonly used for securely transmitting information between parties as a JSON object, often for authentication purposes. By exploiting this weakness, an unauthenticated remote attacker can forge arbitrary JWTs. This allows them to impersonate any user, including administrative accounts, thereby circumventing the software's security mechanisms and achieving full control.
The potential impact of this vulnerability is severe, as it grants attackers the ability to perform any action within the Opcenter X application without authentication. This could lead to data theft, system manipulation, disruption of operations, or further compromise of the industrial control systems that Opcenter X manages. The CVSS v3.1 score for this vulnerability is a critical 10.0, with a vector string indicating it is exploitable over the network with no privileges required and no user interaction.
Siemens has addressed this vulnerability by releasing version V2604 of Opcenter X. The company strongly recommends that all users update to this latest version or a subsequent release to remediate the security risk. Information on updating and accessing the latest version can be found on the Siemens support portal.
CISA has republished the advisory to increase visibility and urges organizations to apply the vendor-supplied patch. In addition to patching, CISA recommends general security measures for industrial control systems. These include minimizing network exposure by ensuring systems are not accessible from the internet, isolating control system networks behind firewalls, and using secure remote access methods like VPNs, ensuring they are also kept up-to-date.
This advisory highlights the ongoing risks associated with authentication mechanisms in industrial software. The improper verification of cryptographic signatures, particularly in token-based authentication systems like JWT, remains a persistent threat vector. Organizations relying on such systems must ensure robust validation processes are in place and that software is regularly updated to mitigate known vulnerabilities.
Siemens ProductCERT initially reported this vulnerability to CISA. The advisory also references CWE-347, "Improper Verification of Cryptographic Signature," as the relevant Common Weakness Enumeration category, underscoring the nature of the flaw. Further operational guidelines for industrial security are available from Siemens to help organizations maintain a secure IT environment.