Siemens Sinec OS vulnerabilities

4 CVEs affecting Siemens Sinec OS, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-35535, published 2026-04-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-2586: Linux Kernel Use-After-Free Vulnerability, published 2024-01-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-06-26. EPSS: 10.2% chance of exploitation in the next 30 days. It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
CVE-2024-50302: Linux Kernel Use of Uninitialized Resource Vulnerability, published 2024-11-19. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2025-03-04. EPSS: 0.8% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways,…
CVE-2024-49894, published 2024-10-21. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out of bounds issue…
CVE-2026-35535, published 2026-04-03. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.