Home / Items
Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 100%
SSA-166980: PHP2Shell Vulnerabilities in Siemens Products
SSA-166980 · Siemens · October 26, 2026
Summary
On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals.
Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.
From Siemens (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
Currently no fix is planned
Currently no fix is available
Update to V20261103 or later version
Red Hat released a PHP security patch for RHEL 8 and 9
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-109618 | 9.8 critical | Exploited | 100.0% |
| CVE-2026-109619 | 8.1 high | Exploited | 100.0% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Siemens | AMIS TS |
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
| Siemens | Building X |
| Siemens | Call stations |
| Siemens | Chargesight |
| Siemens | Climatix Cloud IC |
| Siemens | Climatix Devices |
| Siemens | Connect Insights |
| Siemens | Connect X200 |
| Siemens | Connect X300 |
| Siemens | Connect X500 |
| Siemens | cRSP |
| Siemens | Depotfinity |
| Siemens | Desigo CC |
| Siemens | Desigo DXR2 |
| Siemens | Desigo DXR3 |
| Siemens | Desigo Optic |
| Siemens | Desigo PXC3 |
| Siemens | Desigo PXC4 |
| Siemens | Desigo PXC5 |
| Siemens | Desigo PXC7 |
| Siemens | Energy Engage V2.0SP9 |
| Siemens | Energy Engage V3.1SP1 |
| Siemens | Energy Management System |
| Siemens | Enlighted RTLS |
| Siemens | Enlighted Space |
| Siemens | Heliox Flex Pro |
| Siemens | Heliox H60 |
| Siemens | Heliox Rapid |
| Siemens | Local Monitoring bt-monitoring-vm |
| Siemens | Navigator E&S |
| Siemens | Novigo VANSYS |
| Siemens | Novigo VANSYS core |
| Siemens | PACE-Design |
| Siemens | Sicharge D |
| Siemens | Sicharge D Configuration Backend |
| Siemens | SICHARGE FLEX |
| Siemens | SICHARGE UC |
| Siemens | Sifinity Control |
18 more in the source.
Why it's on these mode pages
- Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- October 26, 2026: Publication Date
- October 27, 2026: Updated the Known not affected list
- October 29, 2026: Added AMIS TS, Energy Engage V2.0SP9, Energy Engage V3.1SP1, Spectrum Power 3, Spectrum Power 4, Spectrum Power 7 and Spectrum Power TG to Affected Products and updated the list of known not affected
- November 5, 2026: Updated Known Not Affected and Known Affected Products list
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com