ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure
Source SecurityWeek
Rated High by SecurityWeek
Data as of 11 Nov 2026, 10:48 UTC
What to do
AI-suggested
Siemens and other vendors recommend applying the provided mitigations as patches are not yet available for several affected products, and some versions will not be fixed. Customers should follow vendor advisories closely for specific mitigation guidance. Since patches are pending or unavailable for some products, applying recommended mitigations is critical to reduce risk. Monitor vendor advisories for updates on patch availability.
Description
Siemens and other industrial technology vendors have disclosed multiple high-severity vulnerabilities affecting various ICS/OT products, including Siemens' ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. Some advisories also address the impact of the Node2Shell vulnerability. Exploitation attempts of Node2Shell have been observed, though not specifically targeting Siemens products. Additional vulnerabilities affect products from Schneider Electric, Beckhoff, Johnson Controls, Hitachi Energy, and others, with issues ranging from arbitrary code execution to privilege escalation. Siemens notes that patches are not yet available for several affected products, and some versions will not receive fixes, recommending customers apply mitigations. The flaws can lead to code injection, unauthorized data access, and system compromise.