PT-2026-58004 · Siemens · Opcenter X

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-56451

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opcenter X versions prior to V2604

Description An issue exists where the application fails to properly validate the algorithm specified in the JSON Web Token (JWT) header. This flaw allows an unauthenticated remote attacker to forge arbitrary JWTs, bypass authentication mechanisms, and impersonate any user, including administrative accounts, which could lead to full unauthorized access to the application.

Recommendations Update to version V2604 or later.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-56451

Affected Products

Opcenter X

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-56451 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-096828.html · Note
• https://twitter.com/OrizonCyber/status/2076977522160394667 · Twitter Post
• https://twitter.com/OrizonCyber/status/2076992617632432563 · Twitter Post
• https://twitter.com/OrizonCyber/status/2076985068048830744 · Twitter Post
• https://twitter.com/OrizonCyber/status/2077000174195429568 · Twitter Post
• https://twitter.com/CVEnew/status/2076980576913867118 · Twitter Post