Threat reportVulnerabilityTL-2026-3565
CVE-2026-58113: Reflected XSS in Siemens Teamcenter Active Workspace Login Redirect (/auth/) Enabling Zero-Interaction Script Execution
CVE-2026-58113 (TL-2026-3565), also tracked as Submit and Execute, is a high-severity software vulnerability scored CVSS 8.5, first published 2026-10-14. It has no confirmed attribution, affects Siemens Teamcenter (Active Workspace), references 2 CVEs (CVE-2026-58113, CVE-2025-23363), maps to 7 MITRE ATT&CK techniques (T1059.007, T1098, T1185), and is covered by 9 detection rules and 3 indicators of compromise.
- CVSS
- 8.5/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 3Indicators of compromise
Key facts for TL-2026-3565
- Threat ID
- TL-2026-3565
- Also known as
- Submit and Execute
- Severity
- HIGH
- CVSS
- 8.5 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, aerospace, automotive, industrial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 3
How CVE-2026-58113 works
Bishop Fox disclosed a reflected XSS in the /auth/ login-redirect endpoint of Siemens Teamcenter. Attacker-controlled query input is reflected unencoded into an auto-submitting HTML form, whose own submission fires an injected onformdata handler. Bishop Fox's PoC silently reassigned workflow delegation via the setSurrogate REST API; Siemens shipped fixed builds on 2026-09-08 (SSA-157465).
CVE-2026-58113 is a reflected cross-site scripting flaw (CWE-79) in the authentication redirect flow (/auth/) of Siemens Teamcenter / Active Workspace. User-supplied query parameters (including locale, correlationId, operationId, sessionId and arbitrary parameter names) are reflected without encoding into HTML attribute contexts of a form element. An unauthenticated remote attacker can therefore break out of the form's action attribute with an encoded double quote (%22) and add arbitrary attributes, such as an event handler.
The technique documented by Bishop Fox is notable because it needs no further user interaction beyond loading the crafted URL while authenticated. The vulnerable page contains a form with id 'autoSubmit' that is submitted programmatically by an updateURL() function called from <body onLoad>. Programmatic form.submit() triggers the 'formdata' event during entry-list construction, so an injected onformdata handler runs automatically. Bishop Fox's example payload appends a parameter whose name is the string: poc" onformdata=confirm('Teamcenter_XSS') x="1, which closes the attribute, adds the handler, and re-balances the markup.
Bishop Fox's PoC chained the XSS with Teamcenter's double-submit CSRF pattern: because the XSRF-TOKEN cookie is readable by JavaScript, injected script can read it and send it as the X-Xsrf-Token header on authenticated same-origin requests (fetch with credentials: 'include' and keepalive: true so the request survives page navigation). The PoC POSTed to /tc/RestServices/Workflow-2014-06-Workflow/setSurrogate, supplying fromResource (victim), toResource (delegate) and date ranges, silently reassigning who can approve workflow tasks (the article's example: approval of aircraft design changes). A restrictive Content-Security-Policy forbidding unsafe-inline event handlers would have blocked the technique.
The vulnerability affects Teamcenter V2412 (< V2412.0013), V2506 (< V2506.0010), V2512 (< V2512.2607) and V2606 (< V2606.2607). NVD lists CVSS 4.0 8.5 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) and CVSS 3.1 6.1 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); the platform score uses the v4.0 value. No in-the-wild exploitation, threat-actor attribution or network IOCs are stated in the sources; a public PoC payload is described in the Bishop Fox write-up. Disclosure: reported 2026-05-30, acknowledged 2026-06-01, CVE assigned 2026-07-03, fixed and published 2026-09-08.
MITRE ATT&CK techniques used in TL-2026-3565
Execution
T1059.007 JavaScript; T1204.001 Malicious Link
Persistence
Privilege Escalation
Collection
T1185 Browser Session Hijacking
Initial Access
T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link
lateral-movement
Affected products and versions in CVE-2026-58113
- Siemens — Teamcenter (Active Workspace)
Vulnerable versions: V2412 < V2412.0013; V2506 < V2506.0010; V2512 < V2512.2607; V2606 < V2606.2607
Fixed in: V2412.0013; V2506.0010; V2512.2607; V2606.2607
Remediation for CVE-2026-58113
Patches
- Siemens SSA-157465: update Teamcenter V2412 to V2412.0013 or later
- Update Teamcenter V2506 to V2506.0010 or later
- Update Teamcenter V2512 to V2512.2607 or later
- Update Teamcenter V2606 to V2606.2607 or later
Immediate actions
- Hunt proxy/WAF/application logs for /auth/ requests containing %22, event-handler names (onformdata, onfocus, onerror, onload) or unexpected parameter names
- Review Teamcenter surrogate/delegation history and correlate with authentication-redirect activity
Workarounds
- Filter requests to /auth/ at a WAF for encoded quotes and event-handler names pending patching
Longer-term hardening
- Implement strict contextual output encoding for HTML attributes
- Allowlist known /auth/ parameters and reject arbitrary parameter names
- Deploy a restrictive Content-Security-Policy forbidding unsafe-inline event handlers
- Regression-test authentication flows for attribute injection and XSS
CVEs associated with CVE-2026-58113
Weaknesses (CWE) in CVE-2026-58113
Timeline of CVE-2026-58113
- Siemens publishes SSA-656895 (CVE-2025-23363), an open redirect in the Teamcenter SSO login service, an earlier flaw in the same authentication-redirect area
- Bishop Fox reports the /auth/ reflected XSS to Siemens ProductCERT
- Siemens acknowledges the report
- CVE-2026-58113 assigned
- Siemens ProductCERT publishes advisory SSA-157465 (V1.0; no workarounds documented) and CVE-2026-58113 is published in NVD with CVSS 4.0 8.5 and CVSS 3.1 6.1
- Siemens releases fixed builds V2412.0013, V2506.0010, V2512.2607, V2606.2607
- NVD record for CVE-2026-58113 last modified; not listed in CISA KEV
- Bishop Fox publishes technical write-up with onformdata PoC and setSurrogate workflow-delegation takeover demonstration
Sources cited for CVE-2026-58113
- Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (Bishop Fox)
- Siemens ProductCERT SSA-157465
- Siemens SSA-157465 CSAF
- NVD: CVE-2026-58113
- NCSC-NL CSAF: CVE-2026-58113
- stack.watch: Siemens Teamcenter XSS via auth redirect
- Siemens SSA-656895 (CVE-2025-23363): earlier Teamcenter SSO open redirect
- CWE-79: Improper Neutralization of Input During Web Page Generation
- OWASP XSS Prevention Cheat Sheet
Detection coverage for TL-2026-3565
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3565 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.