Siemens Teamcenter flaw lets attackers silently hijack accounts via login redirect

An attacker who tricks a logged-in Siemens Teamcenter user into opening a crafted link can execute code in that victim’s browser without any further interaction. According to Bishop Fox, this reflected cross-site scripting flaw, tracked as CVE-2026-58113, allows an attacker to silently change account permissions. The researcher demonstrated how the vulnerability could grant one account the authority to act on behalf of another, effectively hijacking the victim’s privileges within the product lifecycle management system.

In plain English

The flaw exists in the login redirect page that Teamcenter uses during sign-in and single sign-on processes. When a user visits this page, the server builds an HTML form using data from the web request. Bishop Fox found that the server inserts this data directly into the form’s attributes without encoding it. Normally, injecting code into an attribute requires the victim to click or hover over an element to trigger the script. However, this specific page is designed to submit itself automatically the moment it loads. That automatic submission fires the injected code immediately, bypassing the need for any additional user action beyond opening the link.

The background

Siemens Teamcenter is a widely deployed platform for managing engineering designs, bills of materials, and approval workflows for industries like aerospace and automotive. It serves as the system of record for intellectual property and manufacturing releases. Bishop Fox discovered this issue during an authorized penetration test of a Teamcenter Active Workspace deployment, which is the browser-based front end for the suite. The researchers mapped the authentication flow and identified that the /auth/ endpoint reflected arbitrary parameter names into the HTML form, creating the initial injection point that was then weaponized by the page’s auto-submit behavior.

What changes now

Siemens has rated the severity of CVE-2026-58113 as 8.5, which is considered High under CVSS 4.0. The vendor has released fixed builds to address the vulnerability. Organizations using Teamcenter should verify their deployments are updated to these patched versions. Because the flaw allows for silent account delegation changes, it poses a significant risk to the integrity of engineering data and approval workflows. Teams should prioritize applying the update to prevent attackers from leveraging the zero-interaction execution path to compromise user accounts and access sensitive product lifecycle information.

What made it possible

Reflected cross-site scripting vulnerabilities often fail to achieve code execution because they require a second user interaction, such as clicking a link, to trigger the script. This incident highlights how application behavior can bypass that limitation. When a web page automatically submits a form upon loading, it removes the need for user interaction after the initial page load. Security teams usually check whether auto-submitting forms reflect unencoded user input, as this combination turns passive injection into active execution. Defenders should review authentication redirects to ensure input is properly sanitized before being rendered in HTML attributes or form fields.

Background: Cross-site scripting (XSS)

Cross-site scripting injects malicious scripts into trusted sites to steal data from the victim. Cross-site request forgery tricks the victim’s browser into performing unwanted actions on a site where they are authenticated. XSS targets confidentiality; CSRF targets integrity.

Read the full guide: Cross Site Scripting vs CSRF: How to Tell Them Apart and Stop Both

What to do and how to stay safe: Siemens

• Verify that your Siemens Teamcenter instances are running the latest patched builds provided by the vendor to address CVE-2026-58113.
• Monitor authentication logs for unusual delegation changes or permission modifications that occur without corresponding user activity.
• Review other auto-submitting forms in your web applications to ensure they do not reflect unencoded user input into HTML attributes.
• Educate users about the risks of clicking unknown links, even if the vulnerability technically requires only a page load, as social engineering remains the initial vector.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does an attacker need a Teamcenter account to exploit this vulnerability?

No, the attacker does not need a Teamcenter account; they only need the victim to be authenticated when they open the crafted link.

What specific action did the researcher perform to demonstrate the impact?

The researcher used the vulnerability to silently grant one account the ability to act on behalf of another authenticated user.

Has Siemens released a fix for CVE-2026-58113?

Yes, Siemens has shipped fixed builds for the vulnerability, which is rated High severity with a CVSS score of 8.5.