Back Securityweek

ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure

Securityweek •Eduard Kovacs • November 11, 2026

Siemens, Schneider Electric, and several other industrial technology vendors have published new security advisories describing vulnerabilities that could expose affected systems to serious attacks.

Siemens has published nine new advisories covering 10 vulnerabilities. Two advisories describe the impact of the recent Node2Shell vulnerability on the company’s products. Exploitation attempts of Node2Shell have been spotted, but there is no indication of attacks specifically targeting Siemens products.

Siemens has also published advisories informing customers high-severity vulnerabilities in ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. A low-severity issue has been addressed in the Fortigate NGFW used by Ruggedcom APE1808 devices.

The flaws can be exploited to inject code, execute arbitrary code, access unauthorized data, and compromise the system.

Siemens says patches are not yet available for several affected products, and some versions will not receive fixes. Customers are advised to apply the recommended mitigations.

Schneider Electric has published only one advisory informing customers a medium-severity issue in EcoStruxure Power Build Rapsody that could be exploited for arbitrary code execution by processing malicious files.

Germany’s VDE CERT published eight new advisories this week. They cover vulnerabilities found in Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec products. Several of the security holes involve third-party components, including PHP ( PHP2Shell ).

In the days leading up to Patch Tuesday, Phoenix also published advisories describing the impact of the PHP2Shell vulnerabilities. The company also released advisories for several vulnerabilities affecting PLCnext and other products.

Johnson Controls also published a couple of advisories earlier this month. One addresses three EasyIO Neo IO Manager vulnerabilities, including one that can allow privilege escalation and arbitrary code execution.

The second describes an issue in the C•CURE 9000 3.20 / Victor 8.0 installer that could allow an attacker to obtain admin credentials and authentication secrets.

Hitachi Energy has confirmed that at least one of its products is affected by the PHP2Shell vulnerabilities.

Related : ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

Related : Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Siemens Warns of Critical Vulnerabilities in RUGGEDCOM APE1808 Devices Siemens has issued advisories regarding critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting the RUGGEDCOM APE1808 device, which is widely deployed in critical manufacturing sectors. These vulnerabilities, related to the PHP2Shell exploit, allow for arbitrary code execution and have been confirmed to be in the wild. The vulnerabilities were published on October 21, 2026, and were added to CISA's Known Exploited Vulnerabilities (KEV) list on October 26, 2026. Siemens recommends that users implement workarounds and secure their network access to mitigate risks. Patches are not yet available for all affected versions, leaving systems vulnerable. Organizations are urged to follow Siemens' operational guidelines for industrial security. 2 sources 70

Extracted Entities

ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure

The full story

Extracted Entities

Companies (5)

Countries (1)

Platforms (8)

Tools (1)

Vulnerabilities (1)