CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Siemens SIMATIC WinCC Unified

product · product:siemens-simatic-wincc-unified

Coverage
1
first 2026-11-07 → last 2026-11-12
Latest activity
2026-11-12
Brotli flaw: Siemens adds WinCC, UMC, Teamcenter and Opcenter, mostly with no fix; Desigo CC, Mitel, Cisco…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
7
4 hosts

Action items (3)

Do-now tasks recorded on the entries about Siemens SIMATIC WinCC Unified, newest first. Check the date before acting on an older one.

  • Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host, update Siemens Gridscale X DSA V5.3 to V5.4 and Gridscale X PSS®E to V36.8.0, and update WinCC OA V3.20 to V3.20 P17.1 and BRAUMAT and SISTAR to V8.2 Update 5.
    2026-11-07CVE-2026-111497
  • On the SSA-242944 products Siemens lists with no fix or no planned fix (SIMATIC WinCC V7/V8, WinCC Unified, WinCC OA V3.21, WinCC Runtime Professional, WinCC Companion, the Profiling Tool, User Management Component, TIA Administrator, COMOS Walkinside and the Project Server Web Administration Tool), disable Brotli compression and decompression at the application or proxy layer where it is not required and add the IIS request-filtering rule that denies br in the Content-Encoding header on UMC (on TIA Administrator when UMC authentication is enabled), and on every Industrial Edge Management instance running Common Configurator uninstall all Management Applications and put it behind a firewall or WAF.
    2026-11-07CVE-2026-111497
  • Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them.
    2026-11-07CVE-2026-111497

Defender insights

What each entry about Siemens SIMATIC WinCC Unified tells a defender to do, newest first.

2026-11-07NOTABLEexploitedBrotli flaw: Siemens adds WinCC, UMC, Teamcenter and Opcenter, mostly with no fix; Desigo CC, Mitel, Cisco listed

Exposure

Story timeline

  1. 2026-11-07CVE-2026-111497, Brotli decoder flaw in Siemens industrial and software products (Desigo CC, SIMATIC WinCC, Industrial Edge, Teamcenter and Opcenter among them), Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while most Siemens products, the Mitel updates and the Industrial Edge Common Configurator fix are still pending
    trending-vulnerabilitiesBrotli flaw: Siemens adds WinCC, UMC, Teamcenter and Opcenter, mostly with no fix; Desigo CC, Mitel, Cisco listed

Hunting pivots

CVEs (exploited first)
CVE-2026-111497
Releases covered
Siemens SIMATIC WinCC Unified
Tags
actively-exploitedcisa-kevno-patchpatch-availablepoc-publicpre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-07/cve-2026-111497-brotli-desigo-cc-mitel-openscape-cisco-duo · ATT&CK page ↗

Entries about Siemens SIMATIC WinCC Unified (1)

2026-11-07 · view entry permalink →

NOTABLECVE-2026-111497exploitedupdatedNATOA2

CVE-2026-111497, Brotli decoder flaw in Siemens industrial and software products (Desigo CC, SIMATIC WinCC, Industrial Edge, Teamcenter and Opcenter among them), Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while most Siemens products, the Mitel updates and the Industrial Edge Common Configurator fix are still pending

The Brotli decoder flaw CVE-2026-111497 is an out-of-bounds write caused by improper handling of malformed compressed data (Mitel, 2026-10-28), and CISA lists it as exploited (CISA, 2026-10-27). Siemens' advisory SSA-045512, revised on 2026-11-06, lists Desigo CC V8 and V9, all versions, remedied by installing the latest .NET security updates via Windows Update, Gridscale X DSA from V5.3 below V5.4 (fixed in V5.4) and Gridscale X PSS®E below V36.8.0 (fixed in V36.8.0), and scores the flaw CVSS 3.1 9.8 (Siemens ProductCERT, 2026-10-30). Its Industrial Edge advisory SSA-443410 needs no action on a setup with no Management Applications installed, gives fixed versions for six configurator and monitoring applications, and for Common Configurator, which has no fix, says to uninstall all Management Applications and use a firewall or WAF, or stop the application on a device (Siemens ProductCERT, 2026-10-30). Two further Siemens advisories of 2026-11-10, both interim, list 15 industrial and 28 software products, with a fix only for WinCC OA V3.20 and BRAUMAT and SISTAR and mitigations that differ by product, some products having none; neither says anything about exploitation (Siemens ProductCERT, 2026-11-10) (Siemens ProductCERT, 2026-11-10).

Mitel's MISA-2026-0010, revision 5.0 of 2026-11-04, rates the flaw high (CVSS 3.1 8.1) and lists MiVoice Business and five OpenScape products, up to the versions in its table, as affected; for each an update is planned, not released, and workaround articles exist for OpenScape SBC, SESAP and Contact Center (Mitel, 2026-10-28).

Cisco's advisory, version 1.11 of 2026-11-10, says its PSIRT is aware that proof-of-concept exploit code is available and is not aware of any malicious use against any Cisco product; it lists Catalyst SD-WAN, IOS XE, IOS XR and Secure Firewall ASA, FMC and FTD as not impacted and Identity Services Engine as under investigation (Cisco PSIRT, 2026-10-27). Its single fix table, with no per-CVE column, lists Duo Network Gateway (3.4.2), Spaces (24.22.1), RoomOS on Board, Desk and Room Series devices (on-premises 11.41.2.3 and 26.7.4.3) and a longer list whose fixes are dated November 2026 to March 2027 (Cisco PSIRT, 2026-10-27).

The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.

Cisco PSIRT 2026-10-27

Install the latest .NET security updates via Windows Update.

Siemens ProductCERT

Planned update for V11R3.4.5. Workaround available, see KB article

Mitel
Correctionrun 2026-11-08T1309Z-auditactionsaffected_productsbodycvessummary

Siemens' revision of advisory SSA-045512 on 2026-11-06 also added two grid products: Gridscale X DSA from V5.3 up to but excluding V5.4, fixed in V5.4 or later, and Gridscale X PSS®E below V36.8.0, fixed in V36.8.0 or later (Siemens ProductCERT, 2026-10-30). Siemens describes Gridscale X DSA as real-time grid stability assessment and PSS®E as transmission planning and analysis software (Siemens ProductCERT, 2026-10-30).

Updaterun 2026-11-12T0255Z-inteltitleheadlinesummaryaffected_productscvessourcessourcing_noteactionsbodyentities

Siemens published SSA-242944 and SSA-678870 on 2026-11-10, each still interim, extending CVE-2026-111497 to 15 industrial and 28 software products (Siemens ProductCERT, 2026-11-10; Siemens ProductCERT, 2026-11-10). Fixes exist only for SIMATIC WinCC OA V3.20 below V3.20 P17.1 (update to V3.20 P17.1) and for BRAUMAT and SISTAR V8.2 Update 1 to below Update 5 (update to V8.2 Update 5); Siemens plans no fix for the SIMATIC Profiling Tool and lists none available for SIMATIC WinCC V7/V8, WinCC Unified, WinCC Runtime Professional, WinCC Companion, WinCC OA V3.21, TIA Administrator, the User Management Component, COMOS Walkinside, the Project Server Web Administration Tool or, in the software advisory, any of the 28 products, among them Teamcenter V2412 to V2606, the Opcenter family, PADS and Xpedition (Siemens ProductCERT, 2026-11-10; Siemens ProductCERT, 2026-11-10). For the industrial products the mitigation is to disable Brotli compression and decompression at the application or proxy layer where it is not required, and the User Management Component and, when UMC authentication is enabled, TIA Administrator also get an IIS request-filtering rule that denies the value br in the Content-Encoding header (Siemens ProductCERT, 2026-11-10). For the software products Siemens points Teamcenter, the Opcenter family and Process Preparation X to knowledge-base articles that need a Siemens login and were not readable without one, tells HyperLynx, PADS and Xpedition to disable Brotli compression and block it at the network firewall, and lists no mitigation for Innexis Architecture Native Acceleration, Insights Hub, PAVE360 Automotive and Simcenter Executable Digital Twin and Studio (Siemens ProductCERT, 2026-11-10). Polarion, Solid Edge, Calibre, Capital and four other software products are listed as not affected because Node.js is not present or predates Brotli (Siemens ProductCERT, 2026-11-10). Neither advisory says anything about exploitation; the exploited status rests on CISA's listing.

Builds on: Node2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0… · Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows…

vulnerability07 Nov 03:58Zmulti-sourceOpen finding →
Sources: Siemens ProductCERT (SSA-045512) · Siemens ProductCERT (SSA-443410) · Siemens ProductCERT (SSA-242944) · Siemens ProductCERT (SSA-678870) · Mitel (MISA-2026-0010) · Cisco PSIRT · CISA

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cert-portal.siemens.com4 (57%)
  • cisa.gov1 (14%)
  • mitel.com1 (14%)
  • sec.cloudapps.cisco.com1 (14%)
All cited sources (7)