Siemens flaws in October 2026: exploited, unfixed and waiting to be patched
Siemens stories from 1 to 28 October 2026 sort into exploited flaws, a PHP issue with no product list, pending fixes and available updates. Each group needs a different response.
Written by AI from the Brief stories it cites. Code checks that every number and CVE id in it appears in those stories; no person reviews it before it is published. How posts are made · Report an error
In short
- Siemens Software Center flaw CVE-2026-110936 is known exploited and fixed. Versions before 4.0.9.8 are affected. Patch it first.
- The php2shell flaws are known exploited, but Siemens has not named affected products or published fixes. Find PHP-based web components yourself and limit access.
- S7-1500 MFP products and some WinCC versions still await fixes. Use Siemens' mitigations and keep checking its advisories.
- RUGGEDCOM CROSSBOW before 6.0 and Industrial Edge App Publisher before 1.27.9 have fixes available. Schedule the updates.
Exploited flaw with a fix: Software Center
Siemens fixed a DLL sideloading flaw, CVE-2026-110936, in Siemens Software Center. An attacker can place a crafted DLL where the application searches and run code. Siemens said it has been exploited in ClickFix attacks. CISA then added it to its Known Exploited Vulnerabilities catalogue, alongside four Plex Media Server flaws and one in SiteGuard Server Edition. Software Center versions before 4.0.9.8 are affected.123
The stories give two scores for this flaw: CVSS v4 8.4 in one and 6.7 in another. They do not explain the gap. Do not let the lower figure set your priority, because exploitation is already reported. Until you update, limit write access to the folders Software Center searches for DLLs. Tell staff not to paste commands from web pages. Watch for unexpected DLL files in those folders.12
Exploited flaw with no product list: php2shell
The PHP project and researchers disclosed two unauthenticated remote code execution flaws in the PHP runtime on 21 October 2026. They are known as php2shell: CVE-2026-109618 and CVE-2026-109619. On 24 October the story rated this as a plan item, and Siemens advisory SSA-566435 did not name affected products. By 27 October CISA listed both flaws as known exploited. Siemens was still assessing its products and had published no fixes.45
The stories cite SSA-566435 and SSA-166980 and do not say how the two relate. Check both. Other industrial vendors are also checking their products. You cannot wait for a product list. Search your inventory for Siemens software with PHP-based web components. Block internet access to their web interfaces and allow only known administration hosts. Keep those servers apart from controllers. Watch for new processes spawned by PHP web services.54
Fixes still pending on controllers and WinCC
Two S7-1500 stories report multiple flaws in the extra GNU/Linux subsystem. One covers the CPU 1518(F)-4 PN/DP MFP at firmware V3.1.7 or later, including the SIPLUS variant. The other covers all versions of the S7-1500 TM MFP subsystem. Both carry a CVSS of 10.0. Siemens is preparing fixes and recommends mitigations meanwhile. Neither story is marked as known exploited, and neither lists CVE ids or the mitigations themselves. Read Siemens' advisories for those.67
SIMATIC WinCC shows the same gap. A database privilege flaw, CVE-2026-59241, lets an authenticated user with database access run commands on the host. It affects V7.5 (all versions), V8.0 before 8.0.0.11 and V8.1 before 8.1.7. Siemens has released new versions for some products and is preparing further fixes. Update where a fixed version exists. Elsewhere, apply the mitigations and review who holds database access.8
Fixes available but not yet applied
RUGGEDCOM CROSSBOW has two groups of flaws. SQLite flaws in the Station Access Controller could allow code execution, denial of service or data exposure, with a CVSS of 9.8. Other flaws allow database commands, theft of administrative credentials and privilege escalation, with a CVSS of 8.8. Versions before 6.0 are affected, and Siemens has released a new version. Industrial Edge App Publisher before 1.27.9 has two chained flaws that let a network attacker impersonate the management server and run code. Siemens has released an update. None of these is reported as known exploited.91011
Do these things now
First, find and update Siemens Software Center to 4.0.9.8 or later. Second, search your inventory for PHP-based Siemens web components, block internet access to them and watch SSA-566435 and SSA-166980 for fixes. Third, check for S7-1500 MFP products, WinCC V7.5, V8.0 and V8.1, and apply Siemens' mitigations until fixes arrive. Fourth, schedule updates to RUGGEDCOM CROSSBOW 6.0 and Industrial Edge App Publisher 1.27.9 or later.2546
The stories this draws on
- Siemens fixes Software Center flaw already used in attacks Critical
- Siemens Software Center flaw lets local attacker run code; exploitation reported Critical
- CISA adds six actively exploited flaws, including Siemens Software Center Critical
- Siemens reviews which products are hit by PHP 'php2shell' flaws High
- PHP 'php2shell' flaws now listed as known exploited; Siemens still assessing products Critical
- Siemens S7-1500 MFP controllers have many flaws in Linux subsystem Critical
- Siemens S7-1500 TM MFP module has many Linux subsystem flaws Critical
- Siemens SIMATIC WinCC database flaw lets a user run commands on the host High
- Siemens RUGGEDCOM CROSSBOW access controller has SQLite flaws; update available Critical
- Siemens RUGGEDCOM CROSSBOW flaws allow database commands and privilege escalation High
- Siemens Industrial Edge App Publisher flaws could let a network attacker run code High