CISA republishes Siemens fixes and gaps for Node2Shell Brotli flaw
First merged summary.
CISA has republished Siemens guidance on unpatched and fixed products affected by Node2Shell, CVE-2026-111497, with no exploitation reported.
On November 12, 2026, CISA republished Siemens ProductCERT guidance on CVE-2026-111497, nicknamed Node2Shell, a CVSS 9.8 out-of-bounds write in the Google Brotli decoder versions 1.0.3 through 1.2.0. A remote unauthenticated attacker can send a crafted Brotli stream to corrupt decoder memory, disclose data, cause denial of service, or potentially run code. Affected Siemens lines include Industrial Edge Management, RUGGEDCOM APE1808 with PAN-OS, Desigo CC V8 and V9, and named Gridscale X releases. Fixes exist for several products; Common Configurator on IEM and Edge still has none. The Desigo and Gridscale advisory does not report exploitation.
- CVE-2026-111497 is CWE-787 with a CVSS 3.1 score of 9.8.
- Fixed Brotli releases are 1.0.10, 1.1.1, and 1.2.1.
- Cloud Connector Configurator is fixed in V1.24.3 or later; Data Flow Monitoring in V3.0.18 or later.
- Gridscale X DSA before V5.4 should move to V5.4; PSS®E before V36.8.0 to V36.8.0 or later.
- APE1808 with listed PAN-OS versions is known affected; customers should upgrade and contact support.
- Setups with no Management Applications need no action; Hub was fixed in the cloud from October 29.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js published Brotli decoder fixes. · CISA Advisories
- Oct 29, 2026Industrial Edge Hub fixed on the cloud service. · CISA Advisories
- Oct 30, 2026Siemens initially published SSA-898633 for APE1808. · CISA Advisories
- Nov 12, 2026CISA republished Siemens Node2Shell product guidance. · CISA Advisories
What each outlet adds
beyond the shared facts- CISA AdvisoriesIndustrial Edge fix versions, remaining gaps, and Hub cloud protection.
- CISA AdvisoriesAPE1808 PAN-OS scope, SSA-898633, and October 30 publication.
- CISA AdvisoriesDesigo and Gridscale update versions; no exploitation reported.
Coverage
oldest first · one row per article · UTC- · 2d ago
Canadian Centre for Cyber SecurityFirst report
Siemens control products affected by vulnerabilities in AV26-1139
The November 10 notice lists Mendix, SIMATIC, WinCC, ROS#, and other products, without CVE or exploitation details.
- · 13h ago
CISA Advisories
RUGGEDCOM APE1808 PAN-OS affected by PHP2Shell flaws
CVE-2026-109618 scores 9.8 and CVE-2026-109619 scores 8.1; both are use-after-free issues that can lead to remote code execution.
- · 13h ago
Siemens Industrial Edge apps hit by Brotli Node2Shell flaw
CVE-2026-111497 is a CVSS 9.8 out-of-bounds write; several configurators have fixes, while others still need mitigations.
- · 13h ago
Siemens energy and building products affected by PHP2Shell
Fixes exist for some products, including PHP 8.1.34 release 6 and bt-monitoring-vm V20261103; several others have none.
- · 13h ago
RUGGEDCOM APE1808 PAN-OS affected by Node2Shell Brotli flaw
CVE-2026-111497 is a CVSS 9.8 out-of-bounds write in Brotli 1.0.3 through 1.2.0 that can leak memory or run code.
- · 13h ago
Siemens Desigo and Gridscale hit by critical Brotli flaw CVE-2026-111497
CVSS 9.8 out-of-bounds write in Brotli 1.0.3–1.2.0 can yield remote code execution; Siemens published product fixes.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |