# CVE-2026-58113: Reflected XSS in Siemens Teamcenter Active Workspace Login Redirect (/auth/) Enabling Zero-Interaction Script Execution

> Bishop Fox disclosed a reflected XSS in the /auth/ login-redirect endpoint of Siemens Teamcenter. Attacker-controlled query input is reflected unencoded into an auto-submitting HTML form, whose own submission fires an injected onformdata handler. Bishop Fox's PoC silently reassigned workflow delegation via the setSurrogate REST API; Siemens shipped fixed builds on 2026-09-08 (SSA-157465).

- **Published:** 2026-10-14T23:43:46Z
- **Last reviewed:** 2026-10-14T23:43:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3565
- **ID:** TL-2026-3565
- **Severity:** HIGH (CVSS 8.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58113, CVE-2025-23363

## Description

CVE-2026-58113 is a reflected cross-site scripting flaw (CWE-79) in the authentication redirect flow (/auth/) of Siemens Teamcenter / Active Workspace. User-supplied query parameters (including locale, correlationId, operationId, sessionId and arbitrary parameter names) are reflected without encoding into HTML attribute contexts of a form element. An unauthenticated remote attacker can therefore break out of the form's action attribute with an encoded double quote (%22) and add arbitrary attributes, such as an event handler.

The technique documented by Bishop Fox is notable because it needs no further user interaction beyond loading the crafted URL while authenticated. The vulnerable page contains a form with id 'autoSubmit' that is submitted programmatically by an updateURL() function called from <body onLoad>. Programmatic form.submit() triggers the 'formdata' event during entry-list construction, so an injected onformdata handler runs automatically. Bishop Fox's example payload appends a parameter whose name is the string: poc" onformdata=confirm('Teamcenter_XSS') x="1, which closes the attribute, adds the handler, and re-balances the markup.

Bishop Fox's PoC chained the XSS with Teamcenter's double-submit CSRF pattern: because the XSRF-TOKEN cookie is readable by JavaScript, injected script can read it and send it as the X-Xsrf-Token header on authenticated same-origin requests (fetch with credentials: 'include' and keepalive: true so the request survives page navigation). The PoC POSTed to /tc/RestServices/Workflow-2014-06-Workflow/setSurrogate, supplying fromResource (victim), toResource (delegate) and date ranges, silently reassigning who can approve workflow tasks (the article's example: approval of aircraft design changes). A restrictive Content-Security-Policy forbidding unsafe-inline event handlers would have blocked the technique.

The vulnerability affects Teamcenter V2412 (< V2412.0013), V2506 (< V2506.0010), V2512 (< V2512.2607) and V2606 (< V2606.2607). NVD lists CVSS 4.0 8.5 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) and CVSS 3.1 6.1 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); the platform score uses the v4.0 value. No in-the-wild exploitation, threat-actor attribution or network IOCs are stated in the sources; a public PoC payload is described in the Bishop Fox write-up. Disclosure: reported 2026-05-30, acknowledged 2026-06-01, CVE assigned 2026-07-03, fixed and published 2026-09-08.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059.007 JavaScript
- T1098 Account Manipulation
- T1098 Account Manipulation
- T1550.004 Web Session Cookie
- T1185 Browser Session Hijacking

## Sources

- [Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (Bishop Fox)](https://bishopfox.com/blog/xss-siemens-teamcenters-login-redirect-cve-2026-58113)
- [Siemens ProductCERT SSA-157465](https://cert-portal.siemens.com/productcert/html/ssa-157465.html)
- [Siemens SSA-157465 CSAF](https://cert-portal.siemens.com/productcert/csaf/ssa-157465.json)
- [NVD: CVE-2026-58113](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-58113)
- [NCSC-NL CSAF: CVE-2026-58113](https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58113.json)
- [stack.watch: Siemens Teamcenter XSS via auth redirect](https://stack.watch/vuln/CVE-2026-58113/)
- [Siemens SSA-656895 (CVE-2025-23363): earlier Teamcenter SSO open redirect](https://cert-portal.siemens.com/productcert/html/ssa-656895.html)
- [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html)
- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3565