CVE-2026-58113 in Teamcenter
Summary
by MITRE • 09/08/2026
A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2026
The identified vulnerability resides in Siemens Teamcenter software across multiple versions including V2412 prior to 0013, V2506 prior to 0010, and both V2512 and V2606 prior to their respective 2607 updates. This flaw is classified as a Cross-Site Scripting vulnerability specifically manifesting within the authentication redirect flow at the /auth/ endpoint. The core technical issue stems from insufficient input validation and encoding mechanisms when handling user-supplied data that is subsequently reflected into HTML attribute contexts. In standard web application security practices, any data received from external sources must be strictly validated against expected formats and encoded appropriately before being rendered in a browser context to prevent the execution of malicious scripts. The failure to properly encode this specific input allows an attacker to inject arbitrary JavaScript code directly into the page structure during the authentication redirection process.
From an operational perspective, this vulnerability poses a significant risk because it can be exploited by unauthenticated remote attackers without requiring prior access credentials. By crafting a specially designed URL that contains malicious script payloads within parameters used for redirecting after authentication attempts, an attacker can trick authenticated users into loading the compromised link. When such a user accesses the crafted URL through their web browser, the injected JavaScript executes within the context of the Teamcenter application session. This execution environment grants the attacker the ability to interact with the victim's active session as if they were the legitimate user. The consequences include unauthorized access to sensitive engineering data, modification or deletion of critical project files, and potential lateral movement into other connected systems depending on the permissions held by the compromised account.
This type of attack aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Browser Capture or Credential Access through Session Hijacking if cookies are stolen, and potentially Command and Control if further payloads are delivered. The impact extends beyond simple data theft; it undermines the integrity of the Product Lifecycle Management system by allowing unauthorized alterations to design specifications, bill-of-materials, and workflow states that rely on trusted user interactions.
Mitigation strategies must prioritize immediate patching for all affected versions as specified in the vendor security advisory. Organizations should ensure that Teamcenter instances are updated to V2412.0013 or later, V2506.0010 or later, and both V2512.2607 and V2606.2607 or later where applicable. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include implementing Web Application Firewall rules that detect and block suspicious patterns in the /auth/ endpoint parameters, particularly those indicative of script injection such as angle brackets, quotation marks, and event handler attributes like onerror or onload. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected payloads even if they manage to bypass input validation controls. Regular security audits focusing on output encoding practices in authentication flows will also help prevent similar vulnerabilities in future development cycles.