CVE-2026-58113: siemens teamcenter v2412 Cross-site Scripting

Vulnerability summary

CVE-2026-58113 is a high (CVSS 8.5) Cross-site Scripting vulnerability in siemens teamcenter v2412. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.1% of scored vulnerabilities.

Timeline

1. 08-09-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.