# Siemens Energy Products Hit by Critical PHP RCE Flaws

Published: 2026-11-12 · Severity: severe · Sectors: Energy
Canonical: https://vorant.io/reports/59907cf4-0f24-5c8d-a876-69228728578c/siemens-energy-products-hit-by-critical-php-rce-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Two unauthenticated RCE bugs in core PHP runtime affect multiple Siemens Building Automation and Energy products; patches partially available, CVSS 9.8.

Source: cisa.gov — https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.

CISA republished a Siemens ProductCERT advisory (SSA-166980) detailing the impact of two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime, publicly disclosed on October 21, 2026 and dubbed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Because these flaws reside in the PHP runtime itself rather than Siemens code, the advisory covers a broad swath of Siemens' energy and building-automation portfolio, including AMIS TS, blueplanet 360 NX3 variants, Energy Engage (V2.0SP9 and V3.1SP1), Heliox Rapid Local Monitoring, and the Spectrum Power 3/4/7/TG product lines. One of the vulnerabilities is characterized as a Use After Free condition with a CVSS v3 score of 9.8, indicating ease of exploitation and severe impact.

Siemens states it is still assessing the full scope of impact across its product lines and has released updated versions for some affected products while mitigations are recommended for others pending fixes. The advisory has been revised multiple times (five revisions between October 26 and November 12, 2026) as Siemens updated its known-affected and known-not-affected lists, reflecting an evolving investigation rather than a finalized remediation set.

No evidence of active exploitation against Siemens products specifically is mentioned in this advisory; it is a vendor impact assessment following the broader PHP runtime disclosure. CISA and Siemens recommend standard ICS hardening: minimizing network exposure, isolating control system networks behind firewalls, using VPNs for remote access, and applying vendor-provided updates with validation and trained oversight. Given the critical infrastructure (energy sector) deployment and the unauthenticated RCE nature of the underlying PHP flaws, affected operators should prioritize patching per Siemens' per-product guidance and monitor for further advisory updates.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (KEV), CVE-2026-109619 (KEV)

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/59907cf4-0f24-5c8d-a876-69228728578c/siemens-energy-products-hit-by-critical-php-rce-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup