# SZB-f45d3069b4: Siemens reports Node2Shell Brotli flaw (CVE-2026-111497) in Desigo CC and Gridscale X

Siemens advises that its Desigo CC V8 and V9 and Gridscale X DSA and X PSS®E products are affected by CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder with a CVSS score of 9.8.

- Type: Early warning
- Kind: Pending CVE
- Vendor: Siemens
- Product: Desigo CC family; Gridscale X DSA and X PSS®E
- Status: Confirmed
- Sources: 3 distinct
- First seen: 2026-11-12 16:48 UTC
- Confirmed: 2026-11-12 16:48 UTC

Written by a model from the sources below. Verify against them.

## Summary

Siemens advises that its Desigo CC V8 and V9 and Gridscale X DSA and X PSS®E products are affected by CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder with a CVSS score of 9.8. The advisory, republished by CISA, says Siemens has released new versions and recommends updating.

## What to do

- Update Desigo CC V8 or V9 by installing the latest .NET security updates via Windows Update.
- Update Gridscale X DSA to V5.4 or later and Gridscale X PSS®E to V36.8.0 or later.
- Update any Brotli library or binary between 1.0.3 and 1.2.0 to 1.0.10, 1.1.1 or 1.2.1.
- Protect network access to affected devices and keep them off the internet.
- Upgrade RUGGEDCOM APE1808 to the corresponding available PAN-OS version.
- Contact Siemens customer support for additional patch information.

## Timeline

- 2026-11-12 12:00 UTC: Made public by CISA advisories
- 2026-11-12 16:48 UTC: First seen by cve.now
- 2026-11-12 16:48 UTC: Confirmed by CISA advisories

## Evidence (3 sources)

- 2026-11-12 · Official · [CISA advisories](https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-02): “On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497).”
- 2026-11-12 · Official · [CISA advisories](https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-04): “Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability.”
- 2026-11-12 · Official · [CISA advisories](https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03): “Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-f45d3069b4&body=https%3A%2F%2Fcve.now%2FSZB-f45d3069b4%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-f45d3069b4

### Has Siemens confirmed it?

Yes. Confirmed by CISA advisories.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-02, https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-04, https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03

### What should Siemens and Desigo CC users do?

Update Desigo CC V8 or V9 by installing the latest .NET security updates via Windows Update. Update Gridscale X DSA to V5.4 or later and Gridscale X PSS®E to V36.8.0 or later. Update any Brotli library or binary between 1.0.3 and 1.2.0 to 1.0.10, 1.1.1 or 1.2.1. Protect network access to affected devices and keep them off the internet. Upgrade RUGGEDCOM APE1808 to the corresponding available PAN-OS version. Contact Siemens customer support for additional patch information.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-111497.

Source: https://cve.now/CVE-2026-111497

## Tracked as

- [CVE-2026-111497](https://cve.now/CVE-2026-111497.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-f45d3069b4
Site guide for agents: https://cve.now/llms.txt