Critical vulnerability reported in Siemens SIMATIC Virtualization Service
Take action: If you have Siemens SIMATIC Virtualization as a Service (SIVaaS) systems, make sure they are isolated from any untrusted networks because they're exposing critical data on network shares. Then contact Siemens Technical Support since there's no software patch - they need to provide manual configuration fixes.
Learn More
Siemens is reporting a critical security vulnerability affecting its SIMATIC Virtualization as a Service (SIVaaS) that enables access to network shares without authentication.
SIVaaS is hosting controller virtual machines, human-machine interfaces (HMIs), and other critical automation workloads. The exposed network shares potentially contain VM images, configuration files, credentials, operational scripts, and industrial recipes.
The vulnerability is tracked as CVE-2025-40804 (CVSS score 9.3) is caused by incorrect permission assignments and allows remote attackers to access or modify critical data stored on exposed network shares.
The vulnerability affects all versions of SIMATIC Virtualization as a Service (SIVaaS).
Siemens has not released a software patch for this vulnerability. Instead, the company recommends that affected customers contact Technical Support directly for remediation assistance. The fix may require configuration changes or manual interventions instead of automated updates. The company has also reiterated its general industrial security recommendations, emphasizing the need to protect network access to devices with appropriate mechanisms and operate devices within protected IT environments according to Siemens' operational guidelines for industrial security.
