Siemens Desigo, Gridscale
On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Desigo, Gridscale are affected: Desigo CC family V8 vers:all/* (CVE-2026-111497) Desigo CC family V9 vers:all/* (CVE-
- Vendor
- Node.js, Siemens
- Product
- Node.js, SIMATIC / RUGGEDCOM / SINEC / SCALANCE / WinCC / TIA Portal
- EPSS
- 0.83 (p100)
- Fix
- available
- Exposure class
- Developer platform, OT / ICS
Why it ranks 62 (High)
- EPSS 0.83 (high probability of exploitation)
- Product class: developer platform, OT / ICS
- Covered by 27 independent sources
- Fix available
- Government advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CISA ICS Advisories (cisa.gov)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.