Is CVE-2026-22925 actively exploited?

No active exploitation of CVE-2026-22925 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-22925 be exploited remotely?

Yes. CVE-2026-22925 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-22925?

CVE-2026-22925 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-22925

HIGH

CVE-2026-22925

CWE-770Published: May 12, 2026· Updated: May 12, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.1th

Official Description

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets

This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.

NVD Source

Technical Analysis

CVE-2026-22925 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-22925

Siemens SIMATIC

CISA Alerts· May 14, 2026

View CSAF Summary SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version. The following versions of Siemens SIMATIC are affected: SIMATIC CN 4100 vers:intdot/ hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity. View CVE Details Affected Products Siemens SIMATIC Vendor: Siemens Product Version: SIMATIC CN 4100 Product Status: known_affected Remediations [xlite_meta score:79 src:CISA Alerts xlite_fp:24398be83460e8bd8b0800e5360a3f73a2eb239b4cfc4a9afb9694e799548978]

Siemens NX

CISA Alerts· Feb 12, 2026

View CSAF Summary Siemens NX is affected by multiple file parsing vulnerabilities that could be triggered when the application reads files in CGM format. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for NX and recommends to update to the latest version. The following versions of Siemens NX are affected: NX vers:intdot/<2512 (CVE-2026-22923, CVE-2026-22924, CVE-2026-22925) CVSS Vendor Equipment Vulnerabilities v3 7.8 Siemens Siemens NX Stack-based Buffer Overflow, Out-of-bounds Read Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company H [xlite_meta score:53 src:CISA Alerts xlite_fp:d9732ff97951edc39552c89f9b2d8758ac52ebae1557096f5780a22a42509ebd]