PT-2026-7259 · Siemens · Sinec Nms+1

Published 2026-02-10 · Updated 2026-02-25 · CVE-2026-25656

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to 2.15.2.1 User Management Component (UMC) versions prior to 2.15.2.1

Description The application allows unauthorized modification of a configuration file by a user with limited privileges. This could enable an attacker to load malicious DLLs, potentially resulting in arbitrary code execution with SYSTEM privileges.

Recommendations Update SINEC NMS to version 2.15.2.1 or later. Update User Management Component (UMC) to version 2.15.2.1 or later.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2026-05799

CVE-2026-25656

ZDI-26-132

Affected Products

Sinec Nms

User Management

References · 8

• https://osv.dev/vulnerability/CVE-2026-25656 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25656 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-132 · Security Note
• https://bdu.fstec.ru/vul/2026-05799 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-311973.html · Vendor Advisory
• https://twitter.com/CVEnew/status/2021171944188674285 · Twitter Post
• https://t.me/CVEtracker/44303 · Telegram Post
• https://twitter.com/kernyx64/status/2022196625037230178 · Twitter Post