CVE-2026-78556: CWE-295: Improper Certificate Validation in Siemens Industrial Edge App Publisher
Description
CVE-2026-78556 is a high-severity vulnerability in Siemens Industrial Edge App Publisher versions prior to 1.27.9. The software fails to properly validate server certificates during TLS connections, enabling attackers to perform man-in-the-middle attacks and spoof trusted servers. This flaw affects all versions from 0 up to but not including 1.27.9.
CVSS v3.1
Score 7.4high
Affected software
Siemens
Industrial Edge App Publisher
pkg:github/siemens/industrial-edge-app-publisherRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Industrial Edge App Publisher by Siemens contains an improper certificate validation vulnerability (CWE-295) in all versions before 1.27.9. When initiating TLS connections, the software does not correctly verify the server's certificate, which can allow an attacker positioned between the client and server to intercept and relay communications or impersonate a trusted entity. This vulnerability is identified as CVE-2026-78556 with a CVSS 3.1 base score of 7.4, indicating high severity due to network attack vector, high impact on confidentiality and integrity, and no required privileges or user interaction.
Potential Impact
Successful exploitation allows an attacker to intercept and manipulate communications between the Industrial Edge App Publisher client and its server, potentially leading to disclosure of sensitive information and spoofing of trusted servers. This compromises confidentiality and integrity of the data exchanged but does not affect availability.
Mitigation Recommendations
A fix is available in Industrial Edge App Publisher version 1.27.9 and later. Users should upgrade to version 1.27.9 or newer to remediate this vulnerability. No additional vendor advisory details are provided; therefore, verify with Siemens for official patch guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- siemens
- Date Reserved
- 2026-08-24T19:48:32.550Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acdfe9e2cdf04f6564c889b
Added to database: 10/13/2026, 09:49:18 UTC
Last enriched: 10/13/2026, 10:03:35 UTC
Last updated: 10/13/2026, 18:57:34 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.