OTPulse

PHP2Shell Vulnerabilities in Siemens Software Products

Act NowSSA-566435Oct 23, 2026
Siemens
Summary

PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are critical, unauthenticated remote code execution flaws in the PHP runtime disclosed on October 21, 2026. Multiple Siemens software products that embed PHP are affected across all versions, including engineering and manufacturing execution platforms such as Opcenter, Teamcenter, Polarion, Technomatix Plant Simulation, and design tools like PADS Professional and Xpedition suites. No patches are available for any affected product.

What this means
What could happen
An attacker with network access to an affected Siemens application could execute arbitrary code with the privileges of the application runtime, potentially compromising engineering data, manufacturing schedules, or plant simulation models used for process design and validation.
Who's at risk
Organizations using Siemens engineering and manufacturing software are affected, including those running Opcenter MOM/Execution (manufacturing execution), Teamcenter suite (PLM and collaboration), Polarion (requirements management), Tecnomatix Plant Simulation (process design and validation), and PADS/Xpedition design tools (electronics and PCB design). These platforms are typically used by process engineers, manufacturing planners, and design teams to manage production workflows and product data.
How it could be exploited
An attacker sends a crafted request exploiting CVE-2026-109618 or CVE-2026-109619 to a network-exposed Siemens application that embeds vulnerable PHP. No authentication is required. The server processes the request and executes attacker-supplied code, giving the attacker control of the application process and access to its data and functions.
Prerequisites
  • Network connectivity to the affected Siemens application (typically port 80 or 443 for web-based platforms)
  • Application must be exposed to a network from which the attacker can reach it (internal network, internet, or DMZ)
remotely exploitableno authentication requiredlow complexityhigh EPSS score (11.6%)no patch availableaffects engineering and manufacturing systems
Exploitability
Likely to be exploited — EPSS score 11.6%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (26)
26 pending
ProductAffected VersionsFix Status
CADRAAll versionsNo fix yet
DFMExpressAll versionsNo fix yet
HyperLynxAll versionsNo fix yet
Opcenter Connect MOMAll versionsNo fix yet
Opcenter Execution CoreAll versionsNo fix yet
Remediation & Mitigation
0/5
Do now
0/2
WORKAROUNDRestrict network access to affected Siemens applications using firewall rules; limit connectivity to authorized engineering workstations and manufacturing networks only
WORKAROUNDDisable or isolate any Siemens applications listed as affected if they are not actively required for operations
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

WORKAROUNDContact Siemens support regularly to inquire about patch availability and timeline for CVE-2026-109618 and CVE-2026-109619
Long-term hardening
0/2
HARDENINGDeploy network segmentation to separate Siemens engineering and MOM platforms from general corporate networks and internet-facing systems
HARDENINGMonitor for suspicious HTTP requests or unusual application behavior that may indicate exploitation attempts against affected systems
View full Siemens ProductCERT advisory
API: /api/v1/advisories/1ce69591-97a7-4ee5-9393-7b400a075cae

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.