SSA-166980

Siemens Security Advisory by Siemens ProductCERT

SSA-166980: PHP2Shell Vulnerabilities in Siemens Products

Publication Date:	2026-10-26
Last Update:	2026-10-29
Current Version:	V1.2
CVSS v3.1 Base Score:	9.8
CVSS v4.0 Base Score:	9.2

SUMMARY

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals.

Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
AMIS TS All versions affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is available
blueplanet 360 NX3 M6 WM OD IISX All versions affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is available
blueplanet 360 NX3 M6 WM OD IISX - S All versions affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is available
Energy Engage V2.0SP9 All versions affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is planned
Energy Engage V3.1SP1 All versions affected by all CVEs CVE-2026-109618 CVE-2026-109619	Upgrade PHP version to V8.1.34 release 6
Spectrum Power 3 All versions using IHM (NagiosXI) running on Red Hat Enterprise Linux version (RHEL) 7 affected by CVE-2026-109619	Red Hat released a PHP security patch for RHEL 7
Spectrum Power 4	Show more details
Spectrum Power 4 All versions using Nagios or Zabbix affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is available
Spectrum Power 4 All versions with Web Office Portal V3.0, V3.1 and V3.2 affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is available
Spectrum Power 4 All versions with HISViews V1.0 affected by all CVEs CVE-2026-109618 CVE-2026-109619	Currently no fix is available
Spectrum Power 7 All versions using IHM (NagiosXI) affected by all CVEs CVE-2026-109618 CVE-2026-109619	Red Hat released a PHP security patch for RHEL 8 and 9
Spectrum Power TG All versions which are based on Microsoft Windows using the WebConsole and WebQuery components affected by all CVEs CVE-2026-109618 CVE-2026-109619	Upgrade PHP version to V8.5.12

KNOWN NOT AFFECTED PRODUCTS

Un-/Collapse All

Known Not Affected Products	Reason
Building X All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Climatix Cloud IC All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Climatix Devices All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect Insights All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect X200 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect X300 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect X500 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
cRSP All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo CC All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo DXR2 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo DXR3 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo Optic All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC3 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC4 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC5 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC7 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Enlighted RTLS All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Enlighted Space All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Navigator E&S All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Sinteso FS20 EN All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
SiPass integrated All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
SIPORT All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Control All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Control Pro All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Intrusion All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Video All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Workplace Experience All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)

MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.

Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity

PRODUCT DESCRIPTION

Desigo CC is the integrated building management platform for managing high-performing buildings. With its open design, it has been developed to create comfortable, safe and efficient facilities. It is easily scalable from simple single-discipline systems to fully integrated buildings.

Sinteso EN is a fire protection system consisting of fire panels, detection and management stations. It complies with the European standard EN 54 for fire detection and alarm systems.

SiPass integrated is a powerful and extremely flexible access control system.

SIPORT is a comprehensive, modular and reliable system for access control and time management within the Siveillance Access Suite.

Siveillance Control Pro is a command and control solution, specifically designed to support security management at critical infrastructure sites such as ports, airports, oil and gas power generation and distribution, chemical and pharma industries, heavy industries and campus environments.

Siveillance Control, formerly known as Siveillance Viewpoint, is a Physical Security Information Management system (PSIM) that seamlessly consolidates a variety of safety and security systems, such as access control, intrusion detection, and video surveillance, all on one common platform.

Siveillance Video (formerly called Siveillance VMS) is a powerful IP video management software designed for deployments ranging from small and simple to large-scale and high-security. The Siveillance Video portfolio consists of four versions, Siveillance Video Core, Core Plus, Advanced, and Pro, addressing the specific needs of small and medium size solutions up to large complex deployments.

Spectrum Power provides basic components for SCADA, communications, and data modeling for control and monitoring systems. Application suites can be added to optimize network and generation management for all areas of energy management.

The KACO blueprint inverter product line offers a comprehensive range of inverters for solar power applications, from residential to utility-scale, as well as for battery storage and hybrid systems. The inverters are designed for flexible design and installation featuring up to 10 MPPTs to adapt to complex roof architectures, varied string configurations, and challenging shading conditions.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-416: Use After Free

Vulnerability CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS v3.1 Base Score	8.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-416: Use After Free

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-10-26):	Publication Date
V1.1 (2026-10-27):	Updated the Known not affected list
V1.2 (2026-10-29):	Added AMIS TS, Energy Engage V2.0SP9, Energy Engage V3.1SP1, Spectrum Power 3, Spectrum Power 4, Spectrum Power 7 and Spectrum Power TG to Affected Products and updated the list of known not affected

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.