A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512… (CVE-2026-58113)

CVE-2026-58113 is a reflected cross-site scripting vulnerability affecting Teamcenter versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. The vulnerability arises from improper encoding of user input reflected into HTML attribute contexts in the /auth/ endpoint's authentication redirect flow. An unauthenticated remote attacker can craft a URL that, when visited by an authenticated user, executes arbitrary JavaScript in the user's browser, allowing the attacker to perform actions within the victim's Teamcenter session.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated user's browser session. This can lead to unauthorized actions performed on behalf of the victim within Teamcenter, potentially compromising confidentiality and integrity of the user's session data. There is no indication of impact to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid clicking on untrusted links that could exploit this vulnerability. Monitor vendor communications for updates on patches addressing this issue.