Is CVE-2026-27663 actively exploited?

No active exploitation of CVE-2026-27663 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27663 be exploited remotely?

Partially. CVE-2026-27663 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-27663?

CVE-2026-27663 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-27663

MEDIUM

CVE-2026-27663

CWE-770Published: March 26, 2026· Updated: Mar 30, 2026

6.5

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:3.4th

Official Description

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.10). The affected application contains denial-of-service (DoS) vulnerability. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality.

NVD Source

Technical Analysis

CVE-2026-27663 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorAdjacent

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-27663

Siemens SICAM 8 Products

CISA Alerts· Apr 2, 2026

View CSAF Summary Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE - RTUM85 Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SICAM 8 Products are affected: CPCI85 Central Processing/Communication vers:intdot/<26.10 (CVE-2026-27663, CVE-2026-27664) RTUM85 RTU Base vers:intdot/<26.10 (CVE-2026-27663) SICORE Base system vers:intdot/<26.10.0 (CVE-2026-27664) CVSS Vendor Equipment Vulnerabilities v3 7.5 Siemens Siemens SICAM 8 [xlite_meta score:73 src:CISA Alerts xlite_fp:7d25bfddb354b705fe5c9e2f90b0fda6044567079e507fd69f252859b63e0409]