Skip to content
OpenAdvisories
Critical 1 exploited CVE SSA-678870 1 CVE

SSA-678870: Node2Shell/Broccoli2Shell Vulnerabilities in Siemens Software Products

Published Nov 10, 2026 · Updated Nov 10, 2026

Vendor: Siemens Product: Calibre Product: Calibre ICE Product: Capital Product: Designcenter X Essentials Product: HyperLynx Product: Innexis Architecture Native Acceleration 2026 Product: Insights Hub Product: Opcenter Connect Electronics Product: Opcenter Connect MOM Product: Opcenter Execution Core Product: Opcenter Execution Discrete Product: Opcenter Execution Foundation Product: Opcenter Execution Pharma Product: Opcenter Execution Process Product: Opcenter Intelligence Product: Opcenter Intra Plant Logistics Product: Opcenter Quality Product: Opcenter RDnL Product: Opcenter X Product: PADS Pro Essentials Product: PADS Pro Student Edition Product: PADS Professional Product: Pathway to Learning Engineering Product: PAVE360 Automotive 2026 Product: Polarion Product: Process Preparation X Product: Simcenter Executable Digital Twin Product: Simcenter Studio Product: Solid Edge +7 more

Summary

On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products.

Please also have a look on following Software Field Bulletins:

Teamcenter: https://support.sw.siemens.com/en-US/knowledge-base/PL8869204

Polarion: https://support.sw.siemens.com/en-US/knowledge-base/PL8869197

Manufacturing Operations Center (Opcenter) and Process Preparation X: https://support.sw.siemens.com/en-US/knowledge-base/PL8869211

Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026

Revision history

  1. #1

    Publication Date

References