Home / Items
Vendor advisoryKnown exploitedExploit likelihood 100%
SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products
SSA-566435 · Siemens · October 23, 2026
Summary
On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.
From Siemens (vendor's own words, quoted), quoted as published. Check the source before acting.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-109618 | Not scored | Exploited | 100.0% |
| CVE-2026-109619 | Not scored | Exploited | 100.0% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Siemens | AX4 |
| Siemens | CADRA |
| Siemens | Capital |
| Siemens | Designcenter |
| Siemens | Designcenter X |
| Siemens | Designcenter X Essentials |
| Siemens | DFMExpress |
| Siemens | HyperLynx |
| Siemens | Insights Hub |
| Siemens | Opcenter Connect Electronics |
| Siemens | Opcenter Connect MOM |
| Siemens | Opcenter Execution Core |
| Siemens | Opcenter Execution Discrete |
| Siemens | Opcenter Execution Foundation |
| Siemens | Opcenter Execution Pharma |
| Siemens | Opcenter Execution Process |
| Siemens | Opcenter Intelligence |
| Siemens | Opcenter Intra Plant Logistics |
| Siemens | Opcenter Quality |
| Siemens | Opcenter RDnL |
| Siemens | Opcenter X |
| Siemens | PADS Pro Essentials |
| Siemens | PADS Pro Student Edition |
| Siemens | PADS Professional |
| Siemens | PADS Professional - XCR |
| Siemens | PADS Standard - XCR |
| Siemens | PADS Standard & Standard Plus |
| Siemens | Pathway to Learning Engineering |
| Siemens | Polarion |
| Siemens | QuadView |
| Siemens | Simcenter Flomaster |
| Siemens | Simcenter Flux |
| Siemens | Simcenter Simlab |
| Siemens | Solid Edge |
| Siemens | Supply Chain Suite |
| Siemens | Teamcenter |
| Siemens | Teamcenter Product Cost Management |
| Siemens | Teamcenter Share |
| Siemens | Teamcenter Visualization |
| Siemens | Tecnomatix Plant Simulation |
8 more in the source.
Why it's on these mode pages
- Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- October 23, 2026: Publication Date
- October 26, 2026: Added Valor NPI, Solid Edge and Capital to "Known Not Affected Product" list
- October 27, 2026: Added Insights Hub, Simcenter Flux and Simcenter Simlab
- October 28, 2026: Added Opcenter Execution Foundation, Opcenter Quality, Opcenter Intelligence, Opcenter RDnL, AX4, Supply Chain Suite, Opcenter Intra Plant Logistics, Opcenter Connect Electronics, Xcargo, Designcenter and Designcenter X
- October 30, 2026: Added Opcenter Execution Pharma to "Known Not Affected Product" list
- November 3, 2026: Added Pathway to Learning Engineering, Teamcenter Share and Designcenter X Essentials to "Known Not Affected Product" list
- November 4, 2026: Added Opcenter Execution Process and Opcenter Execution Discrete to "Known Not Affected Product" list
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com