Siemens Desigo, Gridscale hit by Node.js flaw
A critical Node.js Brotli decoder flaw (CVE-2026-111497) affects Siemens Desigo CC and Gridscale X products, enabling memory corruption and possible code execution.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-111497 as exploited in the wild.
Siemens has released an advisory, republished by CISA, addressing CVE-2026-111497 ('Node2Shell'), a critical out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js. The flaw, disclosed by the Node.js project on October 21, 2026, could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. Siemens has confirmed the vulnerability affects its Desigo CC building automation family (versions V8 and V9, all versions) and Gridscale X products including DSA (versions >=5.3 and <5.4) and PSS®E (versions <36.8.0). The vulnerability carries a CVSS v3 score of 9.8.
These products are used in building management and power grid monitoring/control contexts, with deployment reported worldwide across Critical Manufacturing, Energy, and Information Technology sectors. Siemens has released updated versions for affected products and recommends applying security updates via documented tooling and procedures, with prior validation and trained staff supervision. No in-the-wild exploitation against Siemens products specifically is mentioned in this advisory, though the underlying Node.js vulnerability was significant enough to warrant an urgent upstream fix.
Defenders operating affected Siemens Desigo CC or Gridscale X deployments should prioritize patching to the latest vendor-provided versions. General ICS hardening practices apply: minimize network exposure of control system devices, isolate control networks behind firewalls, and use VPNs for remote access where required, while recognizing VPN security depends on the security of connected endpoints. Power grid operators should also verify that multi-level redundant secondary protection schemes remain in place as a resilience measure independent of this patch.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-02
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs