Siemens November 2026 ProductCERT Patch Day: security updates
Published 11/11/2026 19:13
Timeline
2 events over 1 d 18 h
- 10/11/2026ConfirmedSiemens ProductCERT advisories+1 d 18 h
- 11/11/2026 19:13Published on WatchtowerPro CISO
In short
Siemens published fixes for 6 vulnerabilities in 6 products on 10/11/2026. 2 are exploited: CVE-2026-111497, CVE-2026-58115. 2 critical (of 5 scored so far). These counts follow the vendor's own feed; the vendor's page has the details of every fix.
Summary
6 fixes in 6 products · 2 exploited · 2 critical (of 5 scored so far)
| Type of flaw | Fixes |
|---|---|
| Other or not stated | 6 |
| Severity | Fixes |
|---|---|
| Critical | 2 |
| High | 3 |
| Not scored yet | 1 |
Products
| Product family | Fixes | Products | Exploited | Critical |
|---|---|---|---|---|
| Node-RED on SIMATIC IoT2050 with Industrial OS | 1 | 1 | 1 | 1 |
| Siemens Software Products | 1 | 1 | 1 | 1 |
| additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 | 1 | 1 | – | – |
| Siemens Engineering Platforms before V20 | 1 | 1 | – | – |
| SIMATIC SCADA and PCS 7 systems | 1 | 1 | – | – |
| SIMATIC WinCC Graphics Designer | 1 | 1 | – | – |
Counted 10/11/2026 01:00 Amsterdam time from the vendor's own feed. A critical count is CVSS 9.0 or more, or the vendor's or NVD's “critical”; “not scored yet” means neither the vendor nor NVD has scored the fix.
Flaws with their own notice
- SIMATIC SCADA and PCS 7 systems - exploited, critical - CVE-2026-58115, CVE-2026-59082, CVE-2026-58114 · its own notice is not published
- Node2Shell: Brotli decoder flaw (CVE-2026-111497) exploited in the wild, fixed in Node.js 22.23.4, 24.22.1, 26.12.1 · Siemens Software Products - exploited, critical - CVE-2026-111497
- Linux kernel: remote use-after-free in IPv4 TCP (CVE-2026-98432), researcher exploit for MPTCP, distributions starting to patch · additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 - CVE-2026-52910
Full details
Siemens's own page for this release lists every fix, the affected versions and the updates.
What to do now
- Install Siemens's November 2026 security updates on every affected system, following the Siemens ProductCERT.
- Start with the flaws the vendor or CISA marks exploited, then the critical ones; the vendor's own page for this release lists every fix: https://cert-portal.siemens.com/productcert/
- Where a flaw has its own Watchtower notice (linked on this page), follow that notice first: it says what is known about it and what to do.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis and all 1 source with their dates. And technology matching: which of your systems run Siemens, at which version, fixed or not - and what each one needs.
Main sources
Siemens ProductCERT Vendor