CVE-2026-27661: medium-severity vulnerability in Siemens SINEC Security Monitor
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
SINEC Security Monitor versions before 4.9.0 leak sensitive information like contributor names and email addresses in file metadata on the server. This exposure could help attackers gather intelligence about the organization and its personnel.
The vulnerability involves information disclosure through metadata on SSM Server in SINEC Security Monitor versions < 4.9.0. Attackers with access to server files or metadata can extract confidential details such as contributor names and email addresses. This information exposure can facilitate social engineering and reconnaissance attacks.
In the same product, most dangerous first.