cve-2026-27662

CVE-2026-27662 is a high-severity vulnerability affecting Siemens SIMATIC HMI Unified Comfort Panels before firmware version V21.0. Disclosed by Siemens and CISA in May 2026, the flaw allows an unauthenticated local attacker to access the built-in web browser via the Control Panel help link. While not a remote code execution issue, it poses a real-world risk in industrial control environments where these panels are deployed near machinery. Siemens recommends updating to V21 or later, hardening Control Panel access, and disabling the taskbar where feasible. Discussions on WindowsForum highlight the importance of applying these mitigations to close this local escape hatch.