Siemens Reyrolle Relay Carries a 9.8 Authentication Bypass

An unauthenticated attacker with network access to a Siemens Reyrolle 7SR5 protection relay's web interface can calculate the device's current and past session IDs and use them to bypass its login entirely, according to a Siemens security advisory. The relay is used to protect, control and monitor equipment in electrical substations, and the flaw, tracked as CVE-2026-62645, carries a CVSS score of 9.8 out of 10.

Siemens published the advisory, SSA-142885, on Sept. 8. CISA republished it as ICS advisory ICSA-26-258-05 on Sept. 15, seven days later, alongside guidance to isolate affected devices behind firewalls and VPNs rather than exposing them directly to the internet.

Thirteen more problems in the same box

The advisory bundles 14 CVEs in total, nine of them new in this release and five carried over from a 2024 disclosure in the device's Mongoose web server component. Versions of the 7SR5 before V2.70 are affected across the board; V2.70 fixes all of them, according to Siemens's own advisory.

CVE	CVSS v3.1	What it does
CVE-2026-62645	9.8	Calculates session IDs to bypass login
CVE-2026-62650	8.8	Bypasses role-based access control
CVE-2026-62648	7.5	Crashes the device via a malformed URL
CVE-2026-62647	7.4	Predicts authentication tokens from a weak random-number generator

One of the lower-scored entries is easy to overlook next to a 9.8 but still notable: CVE-2026-62654, rated 6.8, describes a maintenance mode that can be triggered with a physical key sequence during boot, after which the relay downloads and runs code from a network server with no check on its authenticity. That one needs a hand on the hardware. The rest do not.

The same week, two more Siemens advisories

CISA published two other Siemens ICS advisories on the same day. One, ICSA-26-258-06, covers CVE-2026-80465, an 8.7-rated flaw in the Mendix SAML module that Siemens's own product security team found and disclosed on Sept. 3, in which affected versions fail to validate a SAML response signature, allowing account takeover in some single sign-on setups. The other, ICSA-26-258-07, credits Enzo Alvarez of the security firm Bishop Fox with reporting CVE-2026-58113, a lower-severity reflected cross-site scripting flaw in Siemens's Teamcenter software, rated 6.1.

Siemens's Reyrolle advisory lists no researcher acknowledgment, meaning the company has not said whether the nine new 2026 flaws were found internally, by a customer, or by an outside researcher who has not been named. CISA's advisory does not describe any confirmed exploitation of CVE-2026-62645 in the wild. That puts this disclosure in a different category from the CenterPoint Energy breach CISA and the utility confirmed earlier this month, where an intrusion had already happened, and closer to the Adobe Commerce zero-day CISA added to its exploited catalog only after attacks were already under way. The instruction for operators who cannot update immediately is unchanged from any other ICS advisory: minimize network exposure, place the device behind a firewall, and use a VPN rather than a direct connection for remote access.