Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-89208

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital…

Risk score
44/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.4%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desig…
Affected
See advisory
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: CVE-2026-89208THE FLAWSTHE FIXCVE-2026-89208A vulnerability has beenidentified in Capital EmbeddedAR Classic 431-422 (All…CVSS 5.3 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedSee advisoryYELLOW · PLAN IT INCVE-2026-89208A vulnerability has beenidentified in Capital EmbeddedAR Classic 431-422 (Allversions), Capital Embedded ARClassic R20-11 (All versions <V2303), Desigo PXC00-E.D (Allversions >= V2.3), Desigo…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.22 Oct · CISA advisories (US)Siemens APOGEE, TALON and Desigo PXC/PXMProducts22 Oct · CISA advisories (US)Siemens Capital Embedded AR ClassicCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)348 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

CVE-2026-89208: Yellow, plan it in. A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desig…

The flaws

  • CVE-2026-89208: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital… (CVSS 5.3 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: See advisory

Where it stands

  • No known exploitation

How it unfolded

  1. 22 Oct, CISA advisories (US) (official): Siemens APOGEE, TALON and Desigo PXC/PXM Products
  2. 22 Oct, CISA advisories (US) (official): Siemens Capital Embedded AR Classic

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

Last activity 22 Oct 2026. Patch Forecast updates every hour.