CVE-2026-58113: Siemens Teamcenter Reflected XSS in /auth/ Redirect Flow — Detection and Remediation Guide

Siemens has published a security advisory (tracked by CISA as ICSA-26-258-07) disclosing CVE-2026-58113, a reflected cross-site scripting (XSS) vulnerability in the authentication redirect flow (/auth/) of Teamcenter, its flagship product lifecycle management (PLM) platform. An unauthenticated, remote attacker can craft a malicious URL that injects JavaScript into an authenticated user's Teamcenter session — enabling the attacker to read sensitive engineering data or perform actions as the victim within the session.

Teamcenter is not a niche application. It sits at the center of engineering operations in aerospace, automotive, defense manufacturing, energy, and pharmaceuticals. It holds CAD models, bills of materials, export-controlled technical data, and intellectual property that frequently falls under ITAR/EAR, CMMC, and contractual CUI obligations. A session-hijacking primitive against Teamcenter is a direct path to the crown jewels of a manufacturing enterprise. If your organization runs any of the affected versions, treat this as a priority patch.

Affected Products and Versions

Per the Siemens advisory (SSA format, mirrored in CISA ICSA-26-258-07), the following Teamcenter versions are vulnerable:

All four currently supported release trains are affected, which strongly suggests the vulnerable code in the authentication redirect handler has been present for some time. If you are running an older, unsupported Teamcenter release, assume it is vulnerable and factor that into your upgrade planning — Siemens' fix guidance only covers the trains above.

Technical Analysis

How the Vulnerability Works

This is a reflected XSS (CWE-79) in Teamcenter's authentication redirect flow, reachable at the /auth/ path without authentication. The mechanics are classic but dangerous in this context:

1. The attacker crafts a URL to the Teamcenter /auth/ endpoint with a JavaScript payload embedded in a redirect or error-handling parameter.
2. The victim — already holding an authenticated Teamcenter session (or about to authenticate) — clicks the link, typically delivered via phishing email, Teams/Slack message, or a watering-hole page.
3. The Teamcenter server reflects the unsanitized input back into the authentication response page, where the payload executes in the victim's browser, in the origin context of the Teamcenter server.
4. The injected script runs with the full trust of the Teamcenter web origin: it can read page content, issue authenticated API requests as the victim, capture session tokens not protected by HttpOnly, and perform any action the victim's role permits — including checking out designs, modifying workflow states, or exfiltrating documents.

Because execution happens inside an already-authenticated session, this vulnerability bypasses MFA entirely. MFA protects the login event; it does nothing to stop script execution after the session exists. This is the part defenders consistently underestimate with reflected XSS in enterprise apps.

Exploitation Requirements and Status

• Authentication required to exploit: None for the attacker. The endpoint is reachable pre-authentication.
• User interaction: Required — a victim must click the crafted URL.
• Complexity: Low. Reflected XSS payloads against redirect parameters are trivially constructed once the vulnerable parameter is identified.
• In-the-wild exploitation: Neither the Siemens advisory nor CISA ICSA-26-258-07 reports confirmed active exploitation, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog as of this writing. However, XSS flaws in exposed authentication flows are routinely weaponized within days of advisory publication, and Teamcenter servers are frequently internet-reachable for supplier and partner collaboration — exactly the exposure model where reflected XSS thrives.

Why This Matters Beyond "Just XSS"

In most web apps, reflected XSS is a moderate-severity nuisance. In a PLM platform, the blast radius is categorically different:

• Intellectual property theft: Read access to CAD files, simulation data, and product designs as the victim.
• Supply-chain integrity: An attacker acting as a privileged engineering user could alter approved designs, change revision states, or inject malicious files into released product structures — a supply-chain integrity problem, not just a confidentiality one.
• Pivot potential: Stolen session material and harvested credentials from a fake login prompt injected via XSS can seed follow-on intrusions into the broader enterprise.

Detection & Response

Detection for reflected XSS lives primarily at the web tier: access logs from the Teamcenter web tier (IIS, Apache, or the embedded web server fronting the J2EE stack), reverse proxies, load balancers, and WAF logs. If you are not already shipping Teamcenter web-tier access logs to your SIEM, that gap is your first remediation item — it is your only reliable record of exploitation attempts against /auth/.

Key observables:

• Requests to /auth/ with abnormally long query strings or parameters containing <script, %3Cscript, javascript:, onerror=, onload=, alert(, or double-encoded variants (%253C).
• High-entropy or base64-looking content in redirect/return URL parameters.
• Repeated probing of /auth/ parameters from a single source IP (payload fuzzing behavior).
• Outbound connections from Teamcenter user browsers to unexpected external hosts immediately following an /auth/ request (payload callback/exfil beacon).

Sigma Rules

---
title: Siemens Teamcenter Auth Endpoint XSS Payload Attempt
id: 3f9c1a72-8b44-4e6d-91a2-5c7d8e9f0a1b
status: experimental
description: Detects HTTP requests to the Teamcenter /auth/ authentication redirect flow containing common reflected XSS payload indicators associated with CVE-2026-58113 exploitation attempts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/auth/'
      - '/tc/auth'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - '%253Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cimg'
      - 'alert('
  condition: selection_uri and selection_payload
falsepositives:
  - Vulnerability scanners and authorized penetration tests against the Teamcenter web tier
level: high
---
title: Teamcenter Auth Endpoint Abnormal Query Length or Encoding
id: 8e2b5d14-6c3f-4a78-b2e1-9d4f6a7c8b9d
status: experimental
description: Detects unusually long or heavily URL-encoded query strings against Teamcenter /auth/ endpoints, consistent with payload fuzzing or obfuscated XSS delivery against CVE-2026-58113.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/auth/'
      - '/tc/auth'
  filter_encoding:
    cs-uri-query|contains:
      - '%25'
      - '%3C'
      - '%22'
      - '%27'
  condition: selection and filter_encoding
falsepositives:
  - Legitimate SSO/OAuth redirect chains can carry encoded state parameters; baseline your IdP flow and whitelist known identity provider referrers before enabling at high sensitivity
level: medium

Tuning guidance: The first rule is high-signal — a raw <script in a query string hitting /auth/ has essentially no legitimate explanation. The second rule will catch probing and encoded variants but will fire on some legitimate SSO flows; baseline against your identity provider's redirect patterns (SAML/OIDC state and RelayState parameters) and suppress known-good referrers.

KQL (Microsoft Sentinel)

This query assumes web-tier access logs (IIS/Apache/NGINX or reverse proxy) are ingested via CEF/Syslog into CommonSecurityLog, or WAF logs into a custom table. Adjust field mappings to your ingestion pipeline.

// Hunt: Reflected XSS payload attempts against Teamcenter /auth/ (CVE-2026-58113)
let PayloadIndicators = dynamic(["<script", "%3Cscript", "%253Cscript", "javascript:", "onerror=", "onload=", "%3Cimg", "alert(", "eval(", "document.cookie"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/auth/", "/tc/auth")
| where RequestURL has_any (PayloadIndicators)
| extend PayloadMatched = extract(@"(?i)(<script|%3Cscript|%253Cscript|javascript:|onerror=|onload=|%3Cimg|alert\(|eval\(|document\.cookie)", 1, RequestURL)
| summarize AttemptCount = count(), DistinctTargets = dcount(DestinationHostName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SampleURLs = make_set(RequestURL, 5)
    by SourceIP, SourceUserAgent, PayloadMatched
| order by AttemptCount desc
;
// Correlate: browser-initiated outbound connections from user endpoints
// shortly after a suspicious /auth/ request (payload callback/exfil beacon)
let SuspiciousAuthHits =
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL has "/auth/" and RequestURL has_any ("<script", "%3Cscript", "onerror=", "javascript:")
    | summarize by RequestClientApplication, TimeGenerated, SourceIP;
SuspiciousAuthHits
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
    | where RemoteUrl !has_any ("siemens.com", "microsoft.com")  // extend with your allowlist
) on $left.SourceIP == $right.LocalIP
| project AuthRequestTime = TimeGenerated, Browser = InitiatingProcessFileName, RemoteUrl, RemoteIP, DeviceName
| order by AuthRequestTime desc

Velociraptor VQL

If you cannot rule out prior exploitation, hunt the Teamcenter web-tier access logs directly on the server for historical payload evidence. This artifact greps IIS-style and Apache-style access logs for /auth/ requests carrying XSS indicators.

-- Hunt Teamcenter web-tier access logs for XSS payload attempts against /auth/ (CVE-2026-58113)
LET log_paths = SELECT FullPath FROM glob(globs=[
  'C:/inetpub/logs/LogFiles/**/*.log',
  'C:/Teamcenter*/**/logs/*.log',
  '/var/log/apache2/access*.log',
  '/var/log/httpd/access*.log',
  '/var/log/nginx/access*.log',
  '/opt/teamcenter*/**/logs/*.log'
])

SELECT FullPath AS LogFile,
       Line AS RawLogLine,
       timestamp(string=parse_string_with_regex(string=Line,
          regex='(?P<ts>\\d{2}/[A-Za-z]{3}/\\d{4}:\\d{2}:\\d{2}:\\d{2})').ts,
          format='02/Jan/2006:15:04:05') AS RequestTime
FROM foreach(
  row={ SELECT FullPath FROM log_paths },
  query={
    SELECT FullPath, Line
    FROM parse_lines(filename=FullPath, accessor='file')
    WHERE Line =~ '/auth/'
      AND Line =~ '(?i)(<script|%3Cscript|%253Cscript|javascript:|onerror=|onload=|%3Cimg|alert\\(|document\\.cookie|eval\\()'
  })
ORDER BY RequestTime DESC

Remediation and Verification Script

Teamcenter runs on both Windows and Linux tiers. The following Bash script inventories installed Teamcenter versions (where standard deployment descriptors are present) and scans web-tier logs for historical exploit indicators — useful for both pre-patch exposure assessment and post-patch verification that no attempts succeeded against your environment.

#!/bin/bash
# CVE-2026-58113 exposure assessment for Siemens Teamcenter
# Run on the Teamcenter web/enterprise tier (Linux). Adapt paths for your deployment.

echo "=== Teamcenter Version Inventory ==="
for dir in /opt/Siemens/Teamcenter* /opt/teamcenter* /splm/tc* /usr/Siemens/Teamcenter*; do
  if [ -d "$dir" ]; then
    echo "Found installation: $dir"
    grep -rEho 'version["= :]+[0-9]+\.[0-9.]+' "$dir"/install 2>/dev/null | sort -u | head -5
  fi
done

echo ""
echo "=== Vulnerable Version Check ==="
echo "Affected: V2412 < 2412.0013 | V2506 < 2506.0010 | V2512 < 2512.2607 | V2606 < 2606.2607"
echo "Confirm your deployed patch level against Siemens Support Center before proceeding."

echo ""
echo "=== Historical Exploit Attempt Scan (/auth/ XSS indicators in access logs) ==="
LOG_DIRS="/var/log/apache2 /var/log/httpd /var/log/nginx /opt/teamcenter*/logs"
for d in $LOG_DIRS; do
  [ -d "$d" ] || continue
  echo "Scanning: $d"
  zgrep -Eih '/auth/[^ ]*(<script|%3Cscript|%253Cscript|javascript:|onerror=|onload=|%3Cimg|alert\(|document\.cookie)' \
    "$d"/access*.log* 2>/dev/null | awk '{print $1, $7}' | sort | uniq -c | sort -rn | head -25
done

echo ""
echo "=== Quick Reachability Check: is /auth/ exposed on this host? ==="
curl -sk -o /dev/null -w "HTTP %{http_code} from localhost\n" "https://localhost/tc/auth/" 2>/dev/null
echo "If this host fronts the internet, verify /auth/ exposure with your external attack surface tooling."

Remediation

1. Patch to the fixed release on your train immediately:

   • V2412 → 2412.0013 or later
   • V2506 → 2506.0010 or later
   • V2512 → 2512.2607 or later
   • V2606 → 2606.2607 or later Obtain updates through the Siemens Support Center and validate in a staging environment that mirrors your integrations (Active Workspace, CAD integrations, workflow handlers) before production rollout. PLM patch regressions are real — but so is session hijacking.

2. Reduce exposure of the /auth/ flow until patched: If immediate patching is not possible, restrict access to the Teamcenter web tier at the network boundary. Teamcenter should not be broadly internet-facing; require VPN or ZTNA access for partner/supplier users. Where a reverse proxy or WAF fronts the application, deploy blocking rules for the payload patterns in the Sigma rules above as a compensating control — this is a stopgap, not a fix.

3. Harden session handling: Verify session cookies are set with HttpOnly, Secure, and SameSite=Strict (or Lax where SSO flows require it). HttpOnly does not prevent XSS, but it blunts the most damaging outcome — session token theft.

4. Deploy a Content Security Policy: A restrictive CSP (default-src 'self'; no unsafe-inline) meaningfully raises the bar for payload execution. Test carefully against Active Workspace and any custom Teamcenter web tier extensions before enforcing; start in Content-Security-Policy-Report-Only mode and tune.

5. Review historical logs for exploitation: Run the VQL artifact and log-scan script above across at least the last 90 days of retained web-tier logs. Any confirmed hits warrant an incident response workflow: identify the victim session, review Teamcenter audit logs for actions taken during that session (checkouts, downloads, workflow state changes), and force credential/session resets for affected users.

6. Enable and ship web-tier logging: If Teamcenter's web tier access logs are not in your SIEM today, close that gap with this patch cycle. Detection of this class of attack is impossible without them.

7. User-awareness nudge, targeted: Send a short advisory to your engineering user community: do not click Teamcenter links received via email or chat; navigate directly to the known bookmark. XSS via /auth/ requires a click — a small behavioral change measurably reduces risk while patching proceeds.

References:

• CISA ICS Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07
• Siemens ProductCERT Security Advisories (SSA feed): https://www.siemens.com/global/en/products/services/cert.html

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub