The US Cybersecurity and Infrastructure Security Agency has published five new industrial-control advisories for Siemens products, covering factory and energy systems that operators are being urged to check against their own equipment.

The advisories, listed by CISA on 12 November under codes ICSA-26-316-01 to ICSA-26-316-05, cover Siemens RUGGEDCOM APE1808 devices, Desigo and Gridscale systems, building automation and energy products, and Industrial Edge Management. The Desigo, Gridscale and building automation advisories affect products used in the energy sector, while the RUGGEDCOM devices are used in critical manufacturing.

Two of the five advisories concern the RUGGEDCOM APE1808. Siemens ProductCERT reported a vulnerability affecting all versions of the device, tracked as CVE-2026-111497, in advisory SSA-898633 on 30 October. CISA republished that advisory as ICSA-26-316-04 on 12 November. Siemens recommends protecting network access to affected devices and applying the workarounds set out in related notifications. A separate advisory covers the impact of the PHP2Shell flaws on the Fortigate firewall software used in APE1808 devices.

Part of a wider Siemens security update

The CISA batch follows Siemens' own industrial security update this week, in which the company published nine advisories covering 10 vulnerabilities, according to SecurityWeek. Two of those advisories describe the impact of the Node2Shell vulnerability on Siemens products, and the batch also covers high-severity flaws in products including Simatic SCADA and PCS 7, Mendix Studio Pro and Simatic WinCC Graphics Designer. Siemens said patches were not yet available for several affected products, and some versions will not receive fixes.

Industrial operators should open the advisory that matches their exact product and version, apply the mitigations Siemens recommends, and not assume a single patch covers every system. The advisories differ in affected versions and fixes, and CISA notes that its republications are provided to raise visibility rather than as its own technical assessment.