Advisoriesby IbisSiemensCVE-2026-58113
Siemens Teamcenter: cross-site scripting
Fix: upgrade to V2412.0013 or later (4 fixed versions below)
A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint).
This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Teamcenter V2412 Product | < V2412.0013 | V2412.0013 |
| Teamcenter V2506 Product | < V2506.0010 | V2506.0010 |
| Teamcenter V2512 Product | < V2512.2607 | V2512.2607 |
| Teamcenter V2606 Product | < V2606.2607 | V2606.2607 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79