CVE-2026-56451: Siemens Opcenter X JWT Auth Bypass, CVSS 10.0

Siemens Opcenter X MOM platform has a critical JWT validation bypass, CVE-2026-56451, CVSS 10.0. Unauthenticated remote attackers can forge JWTs, impersonate admins, and take full access to industrial production systems.

On 14 July 2026, Siemens ProductCERT published advisory SSA-096828 covering a critical authentication bypass in the Opcenter X manufacturing operations platform, tracked as CVE-2026-56451. CVSS v3.1 and v4.0 both score 10.0 (Critical)—one of the highest-rated ICS vulnerabilities in recent years.

Overview

Opcenter X is Siemens' cloud manufacturing operations management (MOM) platform. It coordinates production data, quality management, and manufacturing execution across plants. Deployment is widespread in automotive, electronics, pharma, and food and beverage.

The flaw is incorrect validation of the algorithm declared in the JWT header. An attacker crafts a JWT, skips authentication entirely, impersonates any account including admin, and gets full unauthorized access to the application.

Technical Details

Root Cause

Classified as CWE-347: Improper Verification of Cryptographic Signature. The app accepts an attacker-controlled JWT algorithm instead of enforcing the server-configured signing algorithm. That lets an attacker:

• Set the JWT header algorithm to `none` or a weak algorithm
• Strip or forge the signature
• Produce a fully accepted forged token
• Impersonate any identity, including highest-privilege admin accounts

Attack Vector

| Attribute | Detail | | --- | --- | | Attack Vector | Network (AV:N) | | Attack Complexity | Low (AC:L) | | Privileges Required | None (PR:N) | | User Interaction | None (UI:N) | | Scope | Changed (S:C) | | Confidentiality | High (C:H) | | Integrity | High (I:H) | | Availability | High (A:H) |

Impact

• Affected versions: all Opcenter X releases below V2604
• Exploit bar: very low—no auth, no user interaction, remotely exploitable
• Practical harm: full control of the MOM platform; access to production data; modification of process parameters; production disruption
• Threat intel: found internally by Siemens. No public PoC or in-the-wild use reported. CVSS 10.0 bugs get weaponized fast.

Remediation

Immediate Actions

• Patch now: upgrade Opcenter X to V2604 or later. That is the only effective fix.
• Network isolation: until patched, firewall Opcenter X so only trusted hosts can connect.
• Log review: inspect access logs for abnormal JWT use or unauthorized admin activity.

Hardening

• Configure the IT environment per Siemens industrial security operating guidelines
• Put MFA on industrial cloud platforms; do not rely on JWT validation alone
• Rotate API keys and access tokens on a schedule
• Isolate production networks from office networks, physically or logically

References

• Siemens ProductCERT advisory SSA-096828
• CISA ICS Advisory ICSA-26-202-03
• NVD CVE-2026-56451
• Armis CVE details page