CVE-2026-46746CWE-78command-injection

CVE-2026-46746

High · published June 9, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00794 · 55.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-09T14:16Z
Affected products (8)
ProductVersionsFixed in
siemens/sinec_ins≤ 1.0—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
siemens/sinec_insall versions—
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-860189.html · [email protected]
EPSS history
Timeline
  • 09 JUN 08:46Z
    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6)
    cvelistv5