- Siemens says a test key left in the Secure Boot trust list of some SIMATIC IPCs lets software signed with it boot, even with Secure Boot on (CVE-2026-72895).
- Secure Boot only protects a machine if the keys it trusts are the right ones. A development key in that list undoes the protection.
- Update the BIOS, load default settings, then provision Secure Boot keys again. Resetting alone brings the test key back.
A lock is only as good as the keys it accepts
Secure Boot is a check that runs before a computer's operating system starts. The machine looks at the software it is about to load and asks whether it was signed by a key on a trusted list. If not, it refuses. The protection depends entirely on that list.
A Siemens advisory, republished by CISA on October 22, 2026, describes a case where the list contains a key that should not be there. Siemens ProductCERT reported the flaw. The key is a test key, the kind used while a product is being built. The lesson here is that a security feature can be switched on, working as designed, and still protect nothing if the wrong key is trusted.
What the advisory says
The advisory tracks the flaw as CVE-2026-72895. In practice, anyone holding that test key's signing ability could get a system to start from an operating system or UEFI application of their choosing. UEFI is the modern firmware that starts a computer. The advisory states this bypasses Secure Boot protections "even when Secure Boot is enabled."
The weakness type is CWE-1394, Use of Default Cryptographic Key. In plain terms, a key that ships as a default is trusted on every device that carries it.
Three groups of Siemens industrial PCs are affected. SIMATIC IPC BX-21A is affected below version 31.01.13. SIMATIC IPC RW-543A is affected below 1.1.4. The IPC227G, IPC277G, IPC277G PRO, IPC327G and IPC377G are affected below 28.01.15. Siemens has released fixed BIOS versions and recommends updating.
What the advisory leaves out
The advisory does not say how an attacker would get software signed with the test key. It does not say whether the attacker needs physical access or an existing foothold on the machine. It does not report any exploitation. Those gaps matter for judging urgency, and your team should put them to Siemens ProductCERT rather than assume an answer.
CISA also notes that it republished Siemens' advisory verbatim and is not responsible for its technical accuracy. Siemens is the primary source for every detail here.
Why the fix has two extra steps
Updating the BIOS is not the whole job. Once the new BIOS is installed, Siemens says technicians must load the BIOS default settings. Any machine that already had Secure Boot keys set up then needs that key setup done a second time.
A temporary workaround exists. An administrator can delete the test key entry from the machine's key database by hand. The advisory names "DO NOT TRUST - AMI Test PK" for the RW-543A and "insyde-ElkhartLake" for the IPC227G, IPC277G, IPC327G, IPC377G and BX-21A.
There is a catch. Siemens warns that loading default settings restores the test key. So a technician who removes the key and later resets a machine to defaults brings the weakness back. The vendor says upgrading remains the recommended path.
Where these machines sit
The advisory lists the sectors where these products are used: manufacturing, transportation, energy, healthcare and public health, financial services, and government services and facilities. Industrial PCs often run for years on a factory floor or in a plant room. They are updated rarely, because downtime costs money.
That is the human side of this advisory. Someone has to schedule the outage, reset the BIOS, and re-provision keys on each unit. Missing the last step leaves a machine that looks patched but is not.
What to ask your team
Start with inventory. Ask whether any of the listed models are in use, and which BIOS version each runs. Ask who owns the work of resetting defaults and re-provisioning Secure Boot keys, and how you will confirm each machine finished.
Ask whether anyone used the manual workaround. If so, those machines need a note, because a later reset to defaults would restore the test key.
Siemens and CISA also repeat standard advice. Keep control system devices off the internet, place them behind firewalls away from business networks, and use VPNs for remote access while keeping them updated. CISA adds that a VPN is only as secure as the devices connected to it.
Secure Boot is a promise about who may start a machine. This advisory is a reminder to check that the promise names the right parties.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
