Bishop Fox finds zero-interaction XSS in Siemens Teamcenter login redirect
Researchers weaponized a reflected cross-site scripting flaw in Siemens Teamcenter to execute code automatically upon page load, requiring no further victim interaction.
Key points
- CVE-2026-58113 allows automatic JavaScript execution via a crafted link in Siemens Teamcenter.
- Siemens rates the vulnerability as High severity with a CVSS 4.0 score of 8.5.
- Attackers can silently change account delegation settings without user clicks or extra actions.
Security researchers at Bishop Fox disclosed a reflected cross-site scripting vulnerability in Siemens Teamcenter that enables automatic code execution. The flaw, identified as CVE-2026-58113, resides in the platform’s login redirect flow. An attacker needs only to send a victim a malicious link to trigger the exploit, requiring no additional clicks or interactions from the user after the page loads.
The vulnerability allows attackers to inject JavaScript into the browser of any authenticated Teamcenter user. During an authorized assessment, researchers demonstrated how this injection could be used to silently modify account permissions. Specifically, they granted one account the ability to act on behalf of another without the victim’s knowledge. This capability transforms a standard reflection issue into a potent tool for silent credential abuse.
Mechanism and Impact
Siemens has assigned a CVSS 4.0 score of 8.5 to CVE-2026-58113, classifying it as High severity. The company has already shipped fixed builds to address the issue. The flaw exists within the /auth/ endpoint, which handles single sign-on redirects. When a user accesses this page, the server reflects query parameters directly into HTML form attributes without proper encoding.
Typically, reflected cross-site scripting requires a victim to hover over or click an injected element to trigger script execution. However, the Teamcenter login redirect page is designed to submit its own form immediately upon loading. This automatic submission fires the injected code instantly, bypassing the need for a second user action. The only requirement is that the victim opens the crafted URL while logged into the system.
Affected Systems and Scope
Teamcenter is a widely deployed product lifecycle management platform used by manufacturers to manage engineering designs, bills of materials, and approval workflows. The vulnerability was discovered during a penetration test of a Siemens Teamcenter Active Workspace deployment. Active Workspace serves as the browser-based interface for the suite, handling critical data such as CAD files and engineering change orders.
The attacker does not need a Teamcenter account to exploit this flaw. The only prerequisite is that the target user is authenticated when they visit the malicious link. Because the system manages high-value intellectual property and gates manufacturing approvals, compromising user accounts can have significant operational consequences. The silent nature of the delegation change makes detection particularly difficult for standard monitoring tools.
What should you do?
Organizations using Siemens Teamcenter should verify that they have applied the latest fixed builds provided by the vendor. Until updates are confirmed, administrators should monitor for unusual account delegation changes or unexpected permission modifications. Users should be advised to treat unsolicited links with caution, although the technical exploit bypasses typical click-based protections.
What to do and how to stay safe: Siemens
- Verify that your Siemens Teamcenter installation is running the patched versions released to fix CVE-2026-58113.
- Audit recent account delegation changes and permission assignments in Active Workspace to identify any unauthorized modifications.
- Monitor server logs for unusual access patterns to the /auth/ endpoint, specifically looking for malformed or unexpected query parameters.
- Educate users to report suspicious links, even though the exploit technically requires only a page load, as social engineering remains the delivery vector.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-58113 require the victim to click a button?
No, the vulnerability triggers automatically when the victim opens the malicious link, as the page submits its own form upon loading.
What severity rating did Siemens assign to this flaw?
Siemens rates CVE-2026-58113 as High severity with a CVSS 4.0 score of 8.5.
Is a fix available for this vulnerability?
Yes, Siemens has shipped fixed builds to address the reflected cross-site scripting issue in Teamcenter.
