This vulnerability (CVE-2026-33862) in Siemens Teamcenter versions prior to V2312.0014, V2406.0012, V2412.0009, V2506.0005, and all versions of V2512 involves improper encoding or filtering of user input, resulting in a cross-site scripting (CWE-79) flaw. An attacker with low privileges and requiring user interaction can inject malicious scripts that execute in other users' browsers when they access the affected web pages. The CVSS 3.1 base score is 7.3, reflecting high impact on confidentiality and integrity but no impact on availability. The vulnerability is publicly disclosed but lacks an official remediation level or patch at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the victim user. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is released, users should apply strict input validation and output encoding where possible as a temporary mitigation. Monitor Siemens communications for updates on patches or official workarounds.