What is CVE-2025-40759?
A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions < V17 Update 9), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions < V20 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions < V5.2.2.2). Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.
The record classifies CVE-2025-40759 under weakness class CWE-502. Its CVSS v3 base vector states that the flaw requires local access to the host, needs no prior authentication, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. 12 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 429 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 7.8 — HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v4.0 base score
- 8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EPSS (FIRST)
- 0.1% probability of exploitation in the next 30 days, higher than 7.4% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 4.2/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2025-08-12, last modified 2025-12-09
Is CVE-2025-40759 being exploited?
It currently carries a trending score of 7 in the Threadlinqs vulnerability feed.
Affected products and versions
- Siemens: SIMATIC S7-PLCSIM V17, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC STEP 7 V19, SIMATIC STEP 7 V20, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMATIC WinCC V19, SIMATIC WinCC V20, SIMOCODE ES V17, SIMOCODE ES V18, SIMOCODE ES V19
How to fix CVE-2025-40759
No vendor patch reference has been recorded for CVE-2025-40759 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2025-40759
1 tracked threat in the Threadlinqs corpus references CVE-2025-40759, either in the campaign’s CVE list or as an indicator on the campaign record.
- AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure — CRITICAL · 2026-08-19
Sources
Enriched from CVE.org, FIRST EPSS. Last verified by Threadlinqs on .