Vendors and CVEs › Vendors › Siemens
Siemens: industrial cyber security news and vulnerabilities
18 stories in Industrial Cyber Brief name Siemens, 6 on CISA’s list of known exploited flaws, from Tuesday 20 October 2026 to Wednesday 11 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Medium
Opening files in Siemens WinCC Graphics Designer can run attacker code
Siemens reports that Graphics Designer in SIMATIC WinCC before V8.2 runs active content implicitly when a file is opened. An attacker could run arbitrary code on the device.
High
Siemens releases fixes for Node-RED flaw on SIMATIC IoT2050
New: Siemens has released new versions for the affected SIMATIC IoT2050 products. The Node-RED web interface has no authentication, so a remote attacker could create malicious flows and run code with maximum privileges.
Critical
Maximum-severity Node-RED flaw exploited to install Linux malware
Unknown attackers are exploiting CVE-2026-58115 in Node-RED, a programming tool used in industrial systems.
Critical Known exploited
Siemens lists products affected by Node.js Brotli flaw 'Node2Shell'
On 21 October 2026 the Node.js project fixed a flaw in its Brotli decoder, called Node2Shell (CVE-2026-111497). A remote attacker could corrupt memory and possibly run code.
Critical Known exploited
PHP 'php2shell' flaws now listed as known exploited; Siemens still assessing products
CISA now lists the two php2shell flaws (CVE-2026-109618 and CVE-2026-109619) as known exploited. They let an unauthenticated attacker run code remotely in the PHP runtime.
High
Siemens reviews which products are hit by PHP 'php2shell' flaws
On 21 October 2026 the PHP project and researchers disclosed two unauthenticated remote code execution flaws in the PHP runtime, known as "php2shell" (CVE-2026-109618 and CVE-2026-109619).
Critical
Siemens RUGGEDCOM CROSSBOW access controller has SQLite flaws; update available
The SQLite component inside RUGGEDCOM CROSSBOW Station Access Controller has multiple flaws. An attacker could run code, cause a denial of service or obtain sensitive information.
High
Siemens Industrial Edge App Publisher flaws could let a network attacker run code
Two flaws can be chained. An attacker on the network could impersonate the management server and run arbitrary code on the local machine. Siemens has released an update.
High
Siemens RUGGEDCOM CROSSBOW flaws allow database commands and privilege escalation
RUGGEDCOM CROSSBOW has multiple flaws. An attacker could run SQL commands on the database, retrieve administrative credentials, escalate privileges, change configurations or cause denial of service.
Critical
Siemens S7-1500 TM MFP module has many Linux subsystem flaws
Multiple flaws have been found in the extra GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends mitigations for products where fixes are not yet available.
High
Siemens SIMATIC industrial PCs have a Secure Boot test-key flaw
A BIOS vendor test key sits in the UEFI Secure Boot key database. A local attacker with physical or administrative access could boot an operating system signed with it, bypassing Secure Boot.
High
Siemens SIMATIC WinCC database flaw lets a user run commands on the host
A database privilege flaw in several SIMATIC WinCC versions could let an authenticated user with database access run commands on the host system.
Critical
Siemens S7-1500 MFP controllers have many flaws in Linux subsystem
Multiple flaws exist in the extra GNU/Linux subsystem of firmware V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP, including the SIPLUS variant.
Critical Known exploited
Siemens Software Center flaw lets local attacker run code; exploitation reported
Siemens Software Center loads DLL files from an uncontrolled search path. An authenticated local attacker could plant a crafted file and run code with the application's privileges. Siemens released a fixed version.
Critical Known exploited
CISA says Plex, Siemens and SiteGuard flaws are being exploited
CISA added vulnerabilities to its Known Exploited Vulnerabilities catalogue, including Plex Media Server flaws called Plex2Shell. One is a server-side request forgery (CVE-2026-96652, CVSS 5.3).
Critical Known exploited
CISA adds six actively exploited flaws, including Siemens Software Center
CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
Critical Known exploited
Siemens fixes Software Center flaw already used in attacks
Siemens fixed a DLL sideloading flaw (CVE-2026-110936, CVSS v4 8.4) in Siemens Software Center. An attacker could place a crafted DLL where the application searches and run malicious code.
High
Attackers abuse genuine Siemens Software Center to infect Windows PCs
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLL files to infect Windows PCs. They used ClickFix lures, which trick users into running commands themselves.