Siemens Building Automation and Energy Products

Summary

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals. Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available.

The following versions of Siemens Building Automation and Energy Products are affected:

AMIS TS vers:all/* (CVE-2026-109618, CVE-2026-109619)
blueplanet 360 NX3 M6 WM OD IISX vers:all/* (CVE-2026-109618, CVE-2026-109619)
blueplanet 360 NX3 M6 WM OD IISX – S vers:all/* (CVE-2026-109618, CVE-2026-109619)
Energy Engage V2.0SP9 vers:all/* (CVE-2026-109618, CVE-2026-109619)
Energy Engage V3.1SP1 vers:all/* (CVE-2026-109618, CVE-2026-109619)
Heliox Rapid vers:all/* ()Local Monitoring bt-monitoring-vm vers:intdot/<20261103 (CVE-2026-109618, CVE-2026-109619)
Spectrum Power 3 vers:all/* (CVE-2026-109619)
Spectrum Power 4 vers:all/*, vers:all/*, vers:all/* (CVE-2026-109618, CVE-2026-109619, CVE-2026-109618, CVE-2026-109619, CVE-2026-109618, CVE-2026-109619)
Spectrum Power 7 vers:all/* (CVE-2026-109618, CVE-2026-109619)
Spectrum Power TG vers:all/* (CVE-2026-109618, CVE-2026-109619)

CVSS
Vendor
Equipment

v3 9.8
Siemens
AMIS TS

1 Vulnerability

Use After Free

Background

Critical Infrastructure Sectors: Energy
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany

Vulnerabilities
Expand All +

CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Read More

11 Affected Products

AMIS TS