PT-2026-47732 · Siemens · Sinec Ins

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-46746

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC INS versions prior to V1.0 SP2 Update 6

Description The application fails to properly sanitize user input at the '/api/sftp/uploadFiles' endpoint. This allows an authenticated remote attacker to inject shell command payloads through crafted directory names. These payloads are stored and subsequently executed when directory listings are retrieved, enabling the execution of arbitrary commands on the underlying operating system with the privileges of the sinecins service user.

Recommendations Update to version V1.0 SP2 Update 6 or later. As a temporary mitigation, restrict access to the '/api/sftp/uploadFiles' endpoint.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-46746

Affected Products

Sinec Ins

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-46746 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-860189.html · Note
• https://twitter.com/CVEnew/status/2064342529105862841 · Twitter Post