Siemens SICAM 8: CVE-2026-27663 & CVE-2026-27664 Detection and Remediation

---
title: Siemens SICAM Component Service Termination
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unexpected termination or crash of Siemens SICAM core services (CPCI85, RTUM85, SICORE), which may indicate a successful DoS exploitation attempt.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-01
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID:
      - 7031 # Service Control Manager: Service terminated unexpectedly
      - 7034 # Service Control Manager: Service crashed
    ServiceName|contains:
      - 'CPCI85'
      - 'RTUM85'
      - 'SICORE'
  condition: selection
falsepositives:
  - Legitimate service restarts due to maintenance or updates
level: high
---
title: Potential Resource Exhaustion on SICAM Host
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects "Server is running out of resources" events or high memory alerts on hosts running Siemens SICAM software, indicative of CVE-2026-27663/64 exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-092-01
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 2004 # Resource-Exhaustion-Detected
  filter:
    # Focus on known SICAM hostnames or process patterns if environment allows
    # Generic rule to identify the event on critical infrastructure assets
    Channel: 'System'
  condition: selection
falsepositives:
  - Other applications causing memory leaks on the industrial PC
level: medium

// Hunt for Siemens SICAM Service Crashes
Syslog
| where Facility contains 'win' or SyslogMessage contains 'Service Control Manager'
| extend EventID = extract("(EventID:\\s*)(\\d+)", 2, SyslogMessage)
| extend ServiceName = extract("(Service\sName:\\s*)([^"]+)", 2, SyslogMessage)
| where EventID in ('7031', '7034')
| where ServiceName has_any ('CPCI85', 'RTUM85', 'SICORE')
| project TimeGenerated, ComputerIP, SyslogMessage, ServiceName, EventID
| sort by TimeGenerated desc

-- Hunt for Siemens SICAM vulnerable binaries and check versions
SELECT 
  FullPath,
  Mtime,
  Size,
  VersionInfo.ProductVersion,
  VersionInfo.FileVersion,
  VersionInfo.CompanyName
FROM glob(globs=[
    'C:\Program Files*\Siemens\**\CPCI85.exe',
    'C:\Program Files*\Siemens\**\RTUM85.exe', 
    'C:\Program Files*\Siemens\**\SICORE.exe',
    'C:\SICAM\**\*.exe'
])
WHERE VersionInfo.ProductVersion != '' 
  AND (
     // Versions less than 26.10 are vulnerable per advisory
     // Note: String comparison for versions requires careful parsing, 
     // simplistic check for presence here for immediate visibility.
     VersionInfo.ProductVersion !startswith '26.10'
  )

# Check for vulnerable Siemens SICAM 8 Components
# CVE-2026-27663 / CVE-2026-27664

$TargetVersions = @('CPCI85', 'RTUM85', 'SICORE')
$VulnerableThreshold = [version]'26.10.0.0'
$Findings = @()

# Define common installation paths for SICAM on CP-8000 series
$Paths = @(
    "C:\Program Files\Siemens\",
    "C:\Program Files (x86)\Siemens\",
    "C:\SICAM\"
)

Write-Host "[+] Scanning for Siemens SICAM 8 vulnerable components..."

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Write-Host "[+] Scanning path: $Path"
        # Search for executables related to the vulnerable components
        $Files = Get-ChildItem -Path $Path -Recurse -Include '*.exe' -ErrorAction SilentlyContinue | 
                 Where-Object { $TargetVersions -contains $_.BaseName }

        foreach ($File in $Files) {
            $FileInfo = Get-Item $File.FullName
            if ($FileInfo.VersionInfo.FileVersion) {
                try {
                    $FileVer = [version]$FileInfo.VersionInfo.FileVersion
                    # Check if version is strictly less than 26.10.0.0
                    if ($FileVer -lt $VulnerableThreshold) {
                        $Findings += [PSCustomObject]@{
                            Component = $File.BaseName
                            Path      = $File.FullName
                            Version   = $FileVer
                            Status    = 'VULNERABLE'
                        }
                    }
                } catch {
                    # Handle cases where version string is not a standard format
                    Write-Host "[-] Could not parse version for $($File.FullName)"
                }
            }
        }
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "[!] ALERT: Vulnerable components found:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
} else {
    Write-Host "[+] No vulnerable components found via filesystem scan." -ForegroundColor Green
}

Update the affected products to the latest firmware versions provided by Siemens. Specifically, ensure components are updated to versions **equal to or newer than 26.10**: