Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

Siemens reports Node2Shell Brotli flaw (CVE-2026-111497) in Desigo CC and Gridscale X

Siemens advises that its Desigo CC V8 and V9 and Gridscale X DSA and X PSS®E products are affected by CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder with a CVSS score of 9.8.

SZB-f45d3069b4Pending CVEConfirmed

Written by a model from the sources below. Verify against them.

Sources3Confirmed
Kind
Pending CVE
Vendor
Siemens
Product
Desigo CC family; Gridscale X DSA and X PSS®E
Status
Confirmed
First seen
Confirmed

Summary

Siemens advises that its Desigo CC V8 and V9 and Gridscale X DSA and X PSS®E products are affected by CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder with a CVSS score of 9.8. The advisory, republished by CISA, says Siemens has released new versions and recommends updating.

What to do

  • Update Desigo CC V8 or V9 by installing the latest .NET security updates via Windows Update.

  • Update Gridscale X DSA to V5.4 or later and Gridscale X PSS®E to V36.8.0 or later.

  • Update any Brotli library or binary between 1.0.3 and 1.2.0 to 1.0.10, 1.1.1 or 1.2.1.

  • Protect network access to affected devices and keep them off the internet.

  • Upgrade RUGGEDCOM APE1808 to the corresponding available PAN-OS version.

  • Contact Siemens customer support for additional patch information.

Timeline

  1. Made public by CISA advisories
  2. First seen by cve.now
  3. Confirmed by CISA advisories

Evidence 3

  1. Official
    CISA advisories
    “On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497).”
  2. Official
    CISA advisories
    “Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability.”
  3. Official
    CISA advisories
    “Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-f45d3069b4

Has Siemens confirmed it?

Yes. Confirmed by CISA advisories.Source: CISA advisories, CISA advisories, CISA advisories

What should Siemens and Desigo CC users do?

Update Desigo CC V8 or V9 by installing the latest .NET security updates via Windows Update. Update Gridscale X DSA to V5.4 or later and Gridscale X PSS®E to V36.8.0 or later. Update any Brotli library or binary between 1.0.3 and 1.2.0 to 1.0.10, 1.1.1 or 1.2.1. Protect network access to affected devices and keep them off the internet. Upgrade RUGGEDCOM APE1808 to the corresponding available PAN-OS version. Contact Siemens customer support for additional patch information.

Does it have a CVE?

Yes. It is tracked as CVE-2026-111497.Source: CVE-2026-111497

Sources

Tracked as