Siemens RUGGEDCOM APE1808 Hit by PAN-OS Flaws
Siemens RUGGEDCOM APE1808 devices inherit two critical use-after-free vulnerabilities from underlying PAN-OS software, with no evidence of active exploitation.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.
CISA republished a Siemens ProductCERT advisory (SSA-566512) covering Siemens RUGGEDCOM APE1808 industrial devices, which are affected by two vulnerabilities originally disclosed by Palo Alto Networks in PAN-OS (related to PHP2Shell issues). The flaws are classified as use-after-free vulnerabilities with a CVSS v3 base score of 9.8, indicating critical severity in terms of technical impact. All versions of RUGGEDCOM APE1808 are affected.
Siemens and CISA direct customers to Palo Alto Networks' upstream security notifications for workarounds, as this advisory is primarily a pass-through notice rather than an independent vendor patch. No in-the-wild exploitation has been reported. The affected product is deployed worldwide in critical manufacturing environments. Standard ICS defensive guidance applies: minimize network exposure of control system devices, isolate ICS networks behind firewalls, and use secure VPNs with up-to-date patching when remote access is required.
Defenders operating RUGGEDCOM APE1808 devices should consult Palo Alto Networks' PAN-OS advisories for the specific CVE remediation details and apply any available patches or mitigations. Given the use-after-free nature of the flaws and the dependency on PAN-OS, organizations should treat this as a supply-chain-style vulnerability requiring coordination between ICS/OT teams and network security teams managing PAN-OS deployments.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-05
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs