This vulnerability (CVE-2026-33862) in Siemens Teamcenter products involves improper neutralization of input during web page generation, categorized as CWE-79 (Cross-site Scripting). Affected versions include all releases before V2312.0014, V2406.0012, V2412.0009, V2506.0005, and all versions of V2512. The flaw allows an attacker with at least low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users visiting the affected pages. The CVSS v3.1 base score is 7.3, reflecting network attack vector, low attack complexity, privileges required, user interaction, and high impact on confidentiality and integrity but no impact on availability. Siemens has not published an official fix or remediation level, and no patch links are available. The product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation can lead to execution of arbitrary scripts in the context of other users, potentially compromising sensitive information and user session integrity. The vulnerability impacts confidentiality and integrity with high severity but does not affect availability. Exploitation requires user interaction and some privileges on the system. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is released, users should apply strict input validation and output encoding where possible as a temporary mitigation. Monitor Siemens advisories for updates. No official remediation or temporary fixes have been published by Siemens at this time.