Siemens Introduces Supplier-ADP for Enhanced Vulnerability Transparency

In April 2026, Siemens launched the Supplier-ADP (SADP) program to enhance vulnerability transparency. This initiative, part of the CISA's 'Vulnrichment' program, allows suppliers to add context to vulnerabilities from upstream dependencies. A notable example is CVE-2025-47809, which has a CVSS score of 8.2 and originates from Wibu CodeMeter. Siemens issued advisories SSA-201595 and SSA-331739 to inform customers about affected products. The SADP aims to improve the accuracy of vulnerability scanners, increasing 'true positive' rates for Siemens products. Additionally, Siemens plans to publish lists of 'known not affected' products to reduce false positives. This development is expected to enhance the overall security posture for users of Siemens products.

Key Points: • Siemens launched the Supplier-ADP program to improve vulnerability data transparency. • CVE-2025-47809, with a CVSS score of 8.2, is a key vulnerability addressed by the program. • The SADP aims to reduce false positives in vulnerability scanning for Siemens products.