CVE-2026-84854: Siemens PSS SINCAL WibuKey Out-of-Bounds Write — DoS Detection and Mitigation Guide

---
title: Siemens PSS SINCAL or WibuKey Component Crash
description: Detects unexpected termination or crash behavior of PSS SINCAL or WibuKey licensing components, consistent with exploitation of CVE-2026-84854 (out-of-bounds write causing DoS).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
author: Security Arsenal
date: 2026/04/06
id: 3b7f2a91-4c8e-4d1a-9f55-2e6c8a0b1234
status: experimental
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: windows
detection:
  selection_wer:
    Image|endswith:
      - '\WerFault.exe'
    CommandLine|contains:
      - 'sincal'
      - 'WkSrv'
      - 'WibuKey'
  condition: selection_wer
falsepositives:
  - Legitimate application instability unrelated to exploitation
level: medium
---
title: Suspicious Network Connection to WibuKey License Service Port
description: Detects inbound or outbound network connections to the WibuKey network license service port (UDP/TCP 22347) from processes other than the legitimate WibuKey server or SINCAL, indicating potential probing or exploitation attempts against CVE-2026-84854.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
author: Security Arsenal
date: 2026/04/06
id: 8d1e4c72-6a3b-4f90-bc27-9d5e1f8a2345
status: experimental
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort: 22347
  filter_legit:
    Image|endswith:
      - '\WkSrv.exe'
      - '\sincal.exe'
      - '\WkLan.exe'
  condition: selection_port and not filter_legit
falsepositives:
  - Custom WibuKey client tools; inventory legitimate license clients before enabling at high level
level: high
---
title: WibuKey Driver or Service Binary Executed from Non-Standard Path
description: Detects execution of WibuKey licensing binaries from paths outside their standard installation directories, which may indicate tampering or staging of crafted input targeting CVE-2026-84854.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
author: Security Arsenal
date: 2026/04/06
id: 5f2a9d14-7b6c-4e81-a3d9-1c4b7e5f3456
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
      - '\WkSrv.exe'
      - '\WkLan.exe'
      - '\WibuKey.exe'
  filter_standard:
    Image|contains:
      - '\WibuKey\'
      - '\Wibu-Key\'
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection_name and not filter_standard
falsepositives:
  - Portable license utilities deployed by administrators
level: medium

// Hunt for crash events and anomalous process activity involving PSS SINCAL or WibuKey components
// Scope: engineering workstations in OT/engineering VLANs. Correlate with asset inventory of SINCAL hosts.
let SincalHosts = DeviceProcessEvents
| where FileName has_any ("sincal.exe", "WkSrv.exe", "WkLan.exe")
| summarize by DeviceName;
DeviceProcessEvents
| where DeviceName in (SincalHosts)
| where FileName =~ "WerFault.exe"
   or ProcessCommandLine has_any ("sincal", "WibuKey", "WkSrv")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt for unexpected network connections to the WibuKey license port (22347)
DeviceNetworkEvents
| where RemotePort == 22347 or LocalPort == 22347
| where InitiatingProcessFileName !in~ ("WkSrv.exe", "sincal.exe", "WkLan.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc;

// Syslog/CEF path for network devices monitoring engineering VLANs
CommonSecurityLog
| where DestinationPort == 22347
| summarize ConnectionCount = count(), UniqueSources = dcount(SourceIP) by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| where UniqueSources > 3  // multiple sources hitting one license host = possible scanning/exploit attempts
| order by ConnectionCount desc;

-- Hunt artifact: enumerate SINCAL/WibuKey processes, their network bindings,
-- and check whether the legacy WibuKey driver is present on engineering hosts.
-- Deploy against the endpoint group containing OT engineering workstations.

LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)sincal|wksrv|wklan|wibukey'
   OR CommandLine =~ '(?i)sincal|wibukey'

LET license_net = SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort = 22347 OR RemotePort = 22347

LET wibukey_driver = SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Windows/System32/drivers/WibuKey*.sys')

SELECT * FROM processes
UNION ALL
SELECT Pid, Name, LocalAddress AS CommandLine, RemoteAddress AS Exe, RemotePort AS Username, Status AS CreateTime FROM license_net

# CVE-2026-84854 - Siemens PSS SINCAL WibuKey exposure check and mitigation
# Run as Administrator. Test in a lab before fleet deployment.

$report = [ordered]@{}

# --- 1. Detect installed SINCAL versions ---
$sincal = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
                          "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
          Where-Object { $_.DisplayName -match "SINCAL" } |
          Select-Object DisplayName, DisplayVersion, InstallLocation
$report['SincalInstalls'] = $sincal

# Flag affected versions: V21.5 (all), V22.0 (all), V22.5 < 22.5.5
$affected = $sincal | Where-Object {
    $_.DisplayVersion -match '^21\.5' -or
    $_.DisplayVersion -match '^22\.0' -or
    ($_.DisplayVersion -match '^22\.5' -and [version]($_.DisplayVersion -replace '[^0-9.]','') -lt [version]'22.5.5')
}
$report['AffectedInstalls'] = $affected

# --- 2. Detect legacy WibuKey licensing stack ---
$wibuDriver = Get-ChildItem "$env:SystemRoot\System32\drivers\WibuKey*.sys" -ErrorAction SilentlyContinue
$wibuService = Get-Service -Name "*WibuKey*","*WkSrv*" -ErrorAction SilentlyContinue
$report['WibuKeyDriverPresent'] = [bool]$wibuDriver
$report['WibuKeyService'] = $wibuService | Select-Object Name, Status, StartType

if ($wibuDriver -or $wibuService) {
    Write-Warning "Legacy WibuKey licensing stack detected - host is in the vulnerable configuration if SINCAL uses dongle licensing."
}

# --- 3. Check WibuKey network service exposure (UDP/TCP 22347) ---
$listeners = Get-NetUDPEndpoint -LocalPort 22347 -ErrorAction SilentlyContinue
$report['LicensePortListeners'] = $listeners

# --- 4. Apply restrictive firewall rule (only allow known license server) ---
# Replace with your actual WibuKey license server IP. If licensing is local dongle-only,
# block inbound 22347 entirely.
$licenseServer = "10.10.50.25"   # <-- CHANGE ME

Get-NetFirewallRule -DisplayName "SINCAL-WibuKey-Restrict-22347" -ErrorAction SilentlyContinue |
    Remove-NetFirewallRule -Confirm:$false

New-NetFirewallRule -DisplayName "SINCAL-WibuKey-Restrict-22347" `
    -Direction Inbound -Protocol UDP -LocalPort 22347 `
    -RemoteAddress $licenseServer -Action Allow -Profile Any | Out-Null

New-NetFirewallRule -DisplayName "SINCAL-WibuKey-Block-22347-Default" `
    -Direction Inbound -Protocol UDP -LocalPort 22347 -Action Block -Profile Any | Out-Null

# --- 5. Output findings ---
$report | ConvertTo-Json -Depth 4
Write-Host "`nRemediation guidance: migrate SINCAL to current Siemens licensing and upgrade V22.5 to >= 22.5.5 when Siemens releases the update. Track ICSA-26-295-06." -ForegroundColor Cyan