Critical Unauthenticated RCE Flaws in Siemens Building Automation Systems Demand Immediate Patching
Written by AI from the linked story. Not reviewed by an editor. How this works
Two critical unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in Siemens Building Automation and Energy Products, meaning attackers require no credentials to gain full code execution on affected systems. These vulnerabilities are especially dangerous because building automation systems often control physical infrastructure such as HVAC, power, and access controls, making exploitation potentially hazardous beyond the digital realm. The fact that patches are only partially available highlights the operational challenge of maintaining timely vulnerability remediation across complex industrial product portfolios. Organizations relying on unpatched systems remain exposed until vendor fixes are fully deployed, underscoring the need for interim mitigations and network-level compensating controls.
Tactical Insight
Immediate actions
- Apply Siemens-released patches immediately to all affected Building Automation and Energy products where updates are available.
- Isolate unpatched systems from internet-facing networks and restrict access to trusted management hosts only until fixes are available.
- Monitor Siemens ProductCERT advisories continuously and subscribe to alerts for new mitigations as they are released.
Long-term improvements
- Maintain a comprehensive, up-to-date inventory of all OT/ICS devices including firmware and software versions to enable rapid vulnerability scoping.
- Establish a formal emergency patching procedure specifically for critical infrastructure and industrial control systems with defined SLAs.
- Implement network segmentation to isolate building automation systems from corporate IT networks and the public internet.
Detection measures
- Deploy intrusion detection systems (IDS) tuned to detect exploitation attempts targeting PHP-based interfaces on OT-adjacent systems.
- Enable centralized logging of all administrative access and anomalous traffic directed at building automation controllers for rapid threat detection.