Siemens gWAP RCE via Axios prototype pollution

14 May 2026 elevated vulnerability manufacturing

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Prototype pollution in Axios HTTP client allows remote code execution in Siemens gWAP versions below 3.1.1.

Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a vulnerable version of the Axios HTTP client library. The vulnerability stems from a prototype pollution attack chain in Axios that can be escalated to arbitrary code execution or full cloud compromise via AWS IMDSv2 bypass. The issue affects gWAP versions prior to 3.1.1 and is tracked as CVE-2026-40175. Siemens has released version 3.1.1 as a remediation.

The vulnerability exists in Axios versions prior to 1.15.0 and 0.3.1, where a specific gadget attack chain allows attackers to exploit prototype pollution in third-party dependencies bundled with gWAP. Defenders should update to gWAP version 3.1.1 or later immediately. Organizations should also apply defense-in-depth strategies including network segmentation, firewall protection, and restriction of internet-facing access to gWAP instances.

Mentioned in this report

Vulnerabilities CVE-2026-40175

Detection guidance

Prototype Pollution Payload in Web Request URI

ATT&CK T1190

Detects HTTP requests carrying prototype pollution keys (__proto__, constructor.prototype) in the URI, the entry step of Axios gadget chains such as CVE-2026-40175. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Prototype Pollution Payload in Web Request URI
description: Detects web requests whose URI or query string contains prototype pollution
  keys such as __proto__ or constructor[prototype], including URL-encoded forms. This
  is the entry step of gadget chains in Node.js libraries like Axios (CVE-2026-40175
  in Siemens gWAP).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_plain:
    cs-uri-query|contains:
    - __proto__
    - constructor[prototype]
    - constructor.prototype
    - '[__proto__]'
  selection_encoded:
    cs-uri-query|contains:
    - '%5f%5fproto%5f%5f'
    - constructor%5bprototype%5d
  selection_stem:
    cs-uri-stem|contains:
    - __proto__
    - '%5f%5fproto%5f%5f'
  condition: 1 of selection_*
falsepositives:
- Security scanners or penetration tests sending prototype pollution probes
- Developer tooling that passes JavaScript object paths in query strings
level: medium
id: 40d3d2b8-a7e1-56f1-89e9-1f34a1764251
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01

Node.js Process Spawning Shell With Suspicious Commands

ATT&CK T1203

Detects node.exe spawning a command interpreter or LOLBin with recon or download-style arguments, consistent with code execution after exploitation of a Node.js web application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Spawning Shell With Suspicious Commands
description: Detects node.exe spawning cmd, PowerShell or common download LOLBins
  with reconnaissance or payload-retrieval arguments. Indicates possible RCE in a
  Node.js-based web application, such as one reached via an Axios prototype pollution
  chain.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \node.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - 'curl '
    - 'wget '
    - Invoke-WebRequest
    - DownloadString
    - DownloadFile
    - -enc
    - urlcache
    - ipconfig
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node-based build or deployment scripts that call curl or PowerShell on developer
  or build servers
- Administrative Node.js tooling running diagnostic commands
level: medium
id: c1ab2953-1f61-5887-92e4-6ee3cba07905
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01

Node.js Process Connecting to Cloud Instance Metadata Service

ATT&CK T1190

Detects node.exe connecting to the 169.254.169.254 instance metadata endpoint, which may indicate SSRF or IMDSv2 bypass leading to cloud credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Connecting to Cloud Instance Metadata Service
description: Detects node.exe making network connections to the link-local instance
  metadata address. The Axios prototype pollution chain can be escalated to cloud
  compromise through an AWS IMDSv2 bypass. Baseline legitimate SDK use of IMDS before
  enabling alerting.
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1552.005
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \node.exe
    DestinationIp: 169.254.169.254
  condition: selection
falsepositives:
- Node.js applications on cloud VMs using the AWS SDK that legitimately fetch instance
  role credentials
- Cloud agents bundled with Node.js that query instance metadata
level: medium
id: cf96250d-459c-596e-9889-7a1ec6ab0c12
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,572 reports from 145 sources, 596 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs