Siemens Desigo, Gridscale

Siemens Desigo and Gridscale products were found vulnerable to a critical out-of-bounds write flaw (CVE-2026-111497) in the Node.js Brotli decoder component, enabling remote attackers to execute arbitrary code without authentication. This incident highlights the persistent risk of third-party and open-source library vulnerabilities embedded within industrial control system (ICS) software, where patch cycles are often slower than in IT environments. The fact that specific version ranges across multiple product families were affected underscores the need for continuous software composition analysis and timely patch deployment. Delays in patching critical infrastructure software can expose operational technology environments to devastating consequences, including service disruption or physical process interference.