Siemens Building Automation and Energy Products

Two critical unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in Siemens Building Automation and Energy Products, meaning attackers require no credentials to gain full code execution on affected systems. These vulnerabilities are especially dangerous because building automation systems often control physical infrastructure such as HVAC, power, and access controls, making exploitation potentially hazardous beyond the digital realm. The fact that patches are only partially available highlights the operational challenge of maintaining timely vulnerability remediation across complex industrial product portfolios. Organizations relying on unpatched systems remain exposed until vendor fixes are fully deployed, underscoring the need for interim mitigations and network-level compensating controls.