CISA discloses two flaws in all Siemens RUGGEDCOM APE1808 devices

CISA issued ICS Advisory ICSA-26-316-05 on Nov. 12, 2026, disclosing two critical flaws in every version of Siemens RUGGEDCOM APE1808 industrial devices deployed worldwide in critical manufacturing.

CISA’s advisory covers CVE-2026-109618 and CVE-2026-109619, which affect all versions listed as vers:all/*, a version notation meaning every release. An ICS advisory is a notice about security issues in industrial control systems. Security Arsenal gives both flaws a CVSS v3 rating of 9.8, Critical. The flaws trace to PHP2Shell vulnerabilities in Palo Alto Networks PAN-OS components embedded in the Siemens devices; Palo Alto Networks has published information on those PHP2Shell flaws in PAN-OS, and the agency’s advisory ties those flaws to the affected Siemens products.

A use-after-free flaw is a memory error that can let an attacker run code remotely; remote code execution means an attacker can run commands on the target system. CWE-416 is the weakness category for this flaw. Security Arsenal says the problem is such a flaw in PHP’s longjmp() function, tracked as CWE-416, that can enable remote code execution. The outlet said, “The primary weakness is a Use-After-Free condition in PHP’s longjmp() implementation that can lead to remote code execution.”

Security Arsenal says an attacker would probably need to reach the management interface or an open PHP-based web service and send specially crafted HTTP requests. Once the attack works, commands execute on the device’s underlying operating system. The outlet says no exploit code for public use has been confirmed in the wild, that rapid weaponization is likely, and that the flaws do not yet appear in CISA’s Known Exploited Vulnerabilities catalog.

The advisory says Siemens’s devices serve the Critical Manufacturing sector around the world and that the company is based in Germany. Security Arsenal says the device also serves oil-and-gas, transportation, and substation automation networks, where disruption could interrupt operations. It lists all versions as vers:all/*, so no version falls outside the scope.

Security Arsenal says no patched firmware had been released for the APE1808 by Siemens or Palo Alto Networks at publication time. The advisory first came out on Oct. 23, 2026, and CISA published the current version on Nov. 12, 2026. CISA republished the advisory by converting Siemens ProductCERT SSA-566512 (a Siemens ProductCERT security advisory) word for word and provides it as-is without warranty. CISA does not take responsibility for the republished document’s editorial or technical accuracy.

CISA’s advisory says Siemens ProductCERT reported the vulnerabilities to it. CISA said, “This ICSA is a verbatim republication of Siemens ProductCERT SSA-566512 from a direct conversion of the vendor’s Common Security Advisory Framework (CSAF) advisory.” Anyone with questions about the advisory should reach out to Siemens ProductCERT directly.

The guidance covers keeping control system devices off the public internet and putting firewalls between control and business networks. It also covers using current VPNs for any required remote access, and finishing impact analysis and risk assessment before rolling out defensive measures.

Siemens tells customers to protect device network access with appropriate mechanisms and to follow the company’s industrial security guidelines and product manuals. Customers should check Palo Alto Networks’ upstream security notices and apply the workarounds provided there. Security Arsenal says the vendor’s workarounds generally turn off vulnerable PHP functions or limit script execution paths.

Security Arsenal says defenders should turn off web management interfaces they do not need, require strong authentication and IP allow-listing, and watch for shell spawning by web services, which means starting a command shell. When operations require an interface, it should use HTTPS only, with strong authentication and IP allow-listing. Organizations should sign up for Siemens ProductCERT advisories and test firmware updates in a lab before putting them on live industrial systems.

CISA wants organizations to tell it about suspected malicious activity findings for tracking and correlation. It also points organizations to technical information paper ICS-TIP-12-146-01B, Targeted Cyber Intrusion Detection and Mitigation Strategies, on cisa.gov/ics. Security Arsenal says organizations should cooperate with sector-specific ISACs, which are industry information-sharing centers, on threat intelligence sharing, citing CISA guidance in the advisory.