Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 with Industrial OS
Siemens is aware of the recently published research regarding exploitation targeting VulnCheck’s vulnerable Node-RED canary instances.
2026
Node2Shell/Broccoli2Shell - Vulnerability in Google's C decoder (affecting Node.js, Python, ...) (CVE-2026-111497)
Siemens is aware of the vulnerability, CVE-2026-111497, referred to as Broccoli2Shell or Node2Shell, in Google's decoder. An out-of-bounds write can potentially result in a crash, a memory leak or a remote code execution in software which uses a vulnerable version of Brotli.
PHP2Shell - Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Siemens is aware of two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, jointly referred to as PHP2Shell, in PHP. Both result from use-after-free conditions triggered during out-of-memory handling, where stale or uninitialized request memory can be read or branched on by a subsequent request, allowing remote code execution.
Active Exploitation of CVE-2026-110936 in Siemens Software Center
Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Siemens fixed the weakness in version 4.0.9.8 and published advisory SSA-580366 on 15 October. Existing installations update automatically the next time they start.
No Siemens system, product or update channel was breached to our knowledge. EDR vendors and authorities have been engaged for intelligence sharing, enabling broader detection coverage and coordinated defensive actions.
Increasing Vulnerability Transparency with Supplier-ADP
Since 2024, the Cybersecurity and Infrastructure Security Agency (CISA) has implemented the “Vulnrichment” program to enrich CVE data with additional information. The goal is to give additional context and help defenders in assessing the specific risk of these vulnerabilities. Each CVE from cve.org or github has an Authorized Data Publisher (ADP) container where this data is stored.
As a next level, Siemens PSIRT was advocating a further extension of this: The Supplier-ADP (SADP), which was piloted in the last months and finally introduced in April 2026. The SADP comes handy if a supplier like Siemens wants to add information to a vulnerability, which originates in an upstream dependency.