Exploitation timeline
Threadlinqs has recorded 6 Siemens CVEs published between and . The busiest month was 2026-05 (2 new CVEs). 3 of them (50%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Siemens CVEs.
- CVE-2023-44487high 7.5KEVEPSS 100%
- CVE-2021-44228critical 10KEVRansomwareEPSS 94.4%
- CVE-2021-4034high 7.8KEVEPSS 87.8%
- CVE-2025-40947high 7.5EPSS 0.4%
- CVE-2025-40948medium 6.8EPSS 0.3%
- CVE-2020-15791medium 6.5EPSS 0.1%
Products affected
Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 100 distinct Siemens products are affected. The most frequently affected (top 20):
- RUGGEDCOM ROX MX5000 2 CVEs
- RUGGEDCOM ROX MX5000RE 2 CVEs
- RUGGEDCOM ROX RX1400 2 CVEs
- RUGGEDCOM ROX RX1500 2 CVEs
- RUGGEDCOM ROX RX1501 2 CVEs
- RUGGEDCOM ROX RX1510 2 CVEs
- RUGGEDCOM ROX RX1511 2 CVEs
- RUGGEDCOM ROX RX1512 2 CVEs
- RUGGEDCOM ROX RX1524 2 CVEs
- RUGGEDCOM ROX RX1536 2 CVEs
- RUGGEDCOM ROX RX5000 2 CVEs
- 6bk1602-0aa12-0tp0 1 CVE
- 6bk1602-0aa12-0tp0 Firmware 1 CVE
- 6bk1602-0aa22-0tp0 1 CVE
- 6bk1602-0aa22-0tp0 Firmware 1 CVE
- 6bk1602-0aa32-0tp0 1 CVE
- 6bk1602-0aa32-0tp0 Firmware 1 CVE
- 6bk1602-0aa42-0tp0 1 CVE
- 6bk1602-0aa42-0tp0 Firmware 1 CVE
- 6bk1602-0aa52-0tp0 1 CVE
Threat activity
28 tracked threat campaigns reference Siemens products or exploit Siemens CVEs; the 25 most recent are listed.
- CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)CRITICAL
- CVE-2025-39682 — Linux Kernel net/tls rx_list Zero-Length Record Use-After-Free Added to CISA KEV CatalogCRITICAL
- Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)HIGH
- Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices (SSA-864900) — Including Actively Exploited FortiCloud SSO Bypass (CVE-2025-59718/-59719) and FortiOS Heap Overflow (CVE-2025-25249)CRITICAL
- Multiple Vulnerabilities in Nozomi Guardian/CMC Before 25.4.0 on Siemens RUGGEDCOM APE1808 Devices (CVE-2024-13089, CVE-2024-13090, CVE-2025-3719, CVE-2025-40889, et al.)HIGH
- Multiple Fortinet FortiOS Vulnerabilities (incl. CVE-2024-23113) Affect Siemens RUGGEDCOM APE1808 via Bundled Fortinet NGFW < V7.4.3 (SSA-832273)CRITICAL
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec ReferencesCRITICAL
- Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage CampaignHIGH
- ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via Exposed FortiGate DevicesHIGH
- EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked ActorsHIGH
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)HIGH
- AI-Generated Exploit Scripts Targeting Siemens S7 Series PLCs in U.S. Critical InfrastructureHIGH
- AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical InfrastructureCRITICAL
- Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation Compresses Patch TimelinesHIGH
- Sage Water Resources Utah saltwater disposal facility PLC intrusion — Iranian IRGC-CEC (CyberAv3ngers) logic manipulation bypasses pump safeguardsHIGH
- CVE-2026-31431: Linux Local Privilege Escalation Actively Exploited by UMBRAL BISON Within 24 Hours of DisclosureHIGH
- Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A)CRITICAL
- ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT 'BH Alert' Android Spyware Targeting BahrainHIGH
- Siemens Ruggedcom ROX II Three-Stage Zero-Day Exploit Chain (CVE-2025-40948, CVE-2025-40947, CVE-2025-40949)CRITICAL
- XZ Utils Multithreaded Decoder Race Condition (CVE-2025-31115) - B&R & Siemens ICS ImpactHIGH
- Aquatic Panda (Earth Lusca) APT - Log4Shell Exploitation and Multi-Platform Backdoor Campaigns Targeting 17 CountriesCRITICAL
- PCPJack Covert SMTP Relay Network — 230 Hijacked AWS/Google Cloud/Azure Servers via Sliver C2 + Chisel SOCKS TunnelingHIGH
- SHADOW-AETHER-040 & SHADOW-AETHER-064 — Agentic AI-Driven Intrusion Campaigns Targeting LATAM Government and Financial Sectors (Vibe Hacking)CRITICAL
- ZionSiphon — Ideologically Motivated .NET OT Malware Targeting Israeli Water & Desalination Infrastructure (Mekorot, Sorek, Hadera, Ashdod, Palmachim, Shafdan)CRITICAL
- APT41/Silver Dragon Expanding Enterprise Attack Surface — Google Drive C2, AppDomain Hijacking, Cloud/Supply Chain TargetingHIGH
Threat actors targeting Siemens
Named threat actors attributed to campaigns that involve Siemens products or CVEs, with the number of linked campaigns:
How to prioritise Siemens patching
This order follows the data Threadlinqs holds for Siemens, not a generic severity checklist:
- 3 of 6 Siemens CVEs (50%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2023-44487, CVE-2021-44228, CVE-2021-4034.
- 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- Outside KEV, the highest EPSS scores are CVE-2025-40947 (0.4%), CVE-2025-40948 (0.3%), CVE-2020-15791 (0.1%).
- 1 CVE scores Critical and 3 High on CVSS v3 (maximum 10, average 7.7); sequence these after KEV and high-EPSS items.
- 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.