[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNxfFNpzo7THDys3Ijk1O5CBTMKU9PBhgPd4SUnyG8hE":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":31},"d1e6deb3-ab2a-4df9-a690-ac10fa3585e0","Siemens RUGGEDCOM APE1808","siemens-ruggedcom-ape1808-057c02","View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. The following versions of Siemens RUGGEDCOM APE1808 are affected: RUGGEDCOM APE1808 vers:all\u002F* (CVE-2026-109618, CVE-2026-109619) CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM APE1808 1 Vulnerability Use After Free Background Critical Infrastructure Sectors: Critical Manufacturing Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Read More 1 Affected Product RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All) Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H View CVE Details CVE-2026-109619 PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). Read More 2 Affected Products RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All) Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All) Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. Additional Metrics Relevant CWE: CWE-416 Use After Free CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H View CVE Details Acknowledgments Siemens ProductCERT reported these vulnerabilities to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Foperational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https:\u002F\u002Fwww.siemens.com\u002Findustrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Fadvisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https:\u002F\u002Fwww.siemens.com\u002Fproductcert\u002Fterms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-566512 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-23 Date Revision Summary 2026-10-23 1 Publication Date 2026-10-28 2 Updated Remediation to include PAN-OS 2026-11-04 3 Adjusted history entry of V1.1 2026-11-12 4 Initial CISA Republication of Siemens ProductCERT SSA-566512 advisory Legal Notice and Terms of Use","Siemens RUGGEDCOM APE1808 devices are affected by PHP2Shell vulnerabilities in Palo Alto Networks PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are use-after-free flaws that can lead to remote code execution. Siemens advises customers to upgrade to available PAN-OS versions and consult Palo Alto Networks for workarounds.","Siemens RUGGEDCOM APE1808 affected by PHP2Shell vulnerabilities in PAN-OS.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-316-05",null,"2026-11-12T12:00:00+00:00","2026-11-12T18:00:31.8923+00:00",8,[17,20,23,25],{"name":18,"type":19},"RUGGEDCOM APE1808","product",{"name":21,"type":22},"Siemens","vendor",{"name":24,"type":19},"PAN-OS",{"name":26,"type":22},"Palo Alto Networks","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":12,"name":29,"slug":30},"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":27,"icon":12,"name":29,"slug":30},{"category":35},{"id":36,"icon":12,"name":37,"slug":38},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-109618","Vulnerability in Siemens RUGGEDCOM APE1808",{"type":46,"value":50,"context":48},"CVE-2026-109619",[26,21,18],{"controls":53,"vendors":137},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,92,100],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":84,"product_name":89,"url":90,"description":91},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":109,"name":110,"problem":111,"products":112},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",[138,143],{"slug":139,"name":26,"logo_path":140,"roles":141},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[142],"affected",{"slug":144,"name":21,"logo_path":145,"roles":146},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[142],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"unpatched-pan-os-flaws-in-siemens-ruggedcom-devices-enable-remote-code-execution","Unpatched PAN-OS Flaws in Siemens RUGGEDCOM Devices Enable Remote Code Execution","Siemens RUGGEDCOM APE1808 devices running multiple versions of Palo Alto Networks PAN-OS are vulnerable to use-after-free flaws (CVE-2026-109618 and CVE-2026-109619) that can allow attackers to execute arbitrary code remotely. The root cause is the delayed identification and remediation of known vulnerabilities in a third-party software component embedded within critical infrastructure hardware. This is particularly dangerous because RUGGEDCOM devices are commonly deployed in industrial and operational technology environments where exploitation could have serious physical consequences. The incident highlights how vulnerabilities in integrated third-party components can expose critical infrastructure operators who may not monitor upstream vendor advisories closely.",[152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIS2 Article 21(2)(d)",{"NIS2 Article 21(2)(d)":158,"NIS2 Article 21(2)(e)":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 7: Continuous Vulnerability Management (v8)":161,"CIS Control 2: Inventory and Control of Software Assets (v8)":162},"This point requires supply chain security measures, which would include monitoring and responding to security advisories from upstream software suppliers such as Palo Alto Networks whose component is embedded in Siemens hardware.","This point mandates vulnerability handling and disclosure practices in acquisition and maintenance, directly covering the obligation to track and remediate known CVEs in embedded third-party software components like PAN-OS.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control would have driven timely patching of the PAN-OS use-after-free vulnerabilities.","This control requires organizations to continuously assess and remediate vulnerabilities; a formal program would have surfaced the PAN-OS flaws in the RUGGEDCOM devices before exploitation was possible.","Tracking all software running on network appliances, including embedded third-party components like PAN-OS, would have enabled faster identification of which devices were affected by these CVEs."]