Siemens November 2026 Patch Day: PCS 7, WinCC and IoT2050 Flaws, Many Without Fixes

Siemens ProductCERT released its November 2026 Patch Day advisories on 10 November. Most of the list is engineering and business software, but four advisories land squarely in the control room: one for the SIMATIC PCS 7 and WinCC family, one for the WinCC Graphics Designer, one for Node2Shell across Siemens industrial products, and one for the SIMATIC IoT2050 firmware build. Several of them have no fix yet, so mitigations matter more than usual this month.

SSA-970803: PCS 7, WinCC and historians

CVE-2026-58114, rated 7.5 on the Common Vulnerability Scoring System (CVSS), is a weakness in how these systems handle remote login with the old NT LAN Manager (NTLM) protocol. An attacker who has already placed themselves between two systems on the network can relay that login and impersonate a real user, for example against the SQL Server database that WinCC uses. Siemens says that could lead to session takeover and running code with the victim's rights. Fourteen products are listed, including SIMATIC PCS 7 V9.1, SIMATIC BATCH V9.1, WinCC V7.5, V8.0 and V8.1, WinCC Runtime Professional V17 through V21, Process Historian 2020 and 2022, and Information Server 2020 and 2022. Siemens has no fix planned for the PCS 7 V9.1 generation, BATCH, Process Historian and Information Server, and no fix yet for WinCC. The mitigation is to configure the SQL Server database to encrypt its communication, following Siemens support article 109818202.

SSA-979641: WinCC Graphics Designer

CVE-2026-59082, rated 7.8, means the Graphics Designer in WinCC before V8.2 runs active content inside a file as soon as the file is opened. A booby-trapped screen file sent to an engineer could run code on the engineering station. WinCC V7.5, V8.0 and V8.1 have no fix yet. Only open project and screen files from trusted sources.

SSA-242944: Node2Shell in Siemens industrial products

CVE-2026-111497, rated 9.8, is the Brotli decoder flaw known as Node2Shell, already on the Known Exploited Vulnerabilities (KEV) catalog of the Cybersecurity and Infrastructure Security Agency (CISA). Siemens now lists its industrial products. Fixes exist for WinCC OA V3.20 (update to V3.20 P17.1) and for SIMATIC BRAUMAT and SISTAR V8.2 (update to V8.2 Update 5). There is no fix yet for WinCC OA V3.21, WinCC Unified PC Runtime, WinCC Unified for Industrial Edge, WinCC Runtime Professional, WinCC V7 and V8, WinCC Companion, TIA Administrator, User Management Component and COMOS Walkinside. Siemens advises turning off Brotli compression at the application or proxy layer where it is not strictly needed.

SSA-724261: IoT2050 firmware build

CVE-2026-109830, rated 7.3, is a command injection flaw in the firmware update tool of meta-iot2050 from V01.03.01. Someone who can tamper with its configuration file can run commands as root. No fix is available yet.

What to do now

1. Inventory your PCS 7, WinCC, BATCH, Process Historian, Information Server and WinCC OA versions against these four advisories, and patch WinCC OA V3.20, BRAUMAT and SISTAR now.
2. Turn on encrypted SQL Server communication per Siemens article 109818202, and limit NTLM where your system design allows.
3. Disable Brotli compression on WinCC web servers and proxies that do not need it, and keep those web interfaces off the business network.
4. Tell engineers to open project and screen files only from trusted sources, and lock down who can change IoT2050 configuration files.

Prior Red Tiger advisory on Node2Shell: https://www.redtigersecurity.com/advisory/brotli-cve-2026-111497-cisa-kev

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Siemens ProductCERT, 10 November 2026: SSA-970803 https://cert-portal.siemens.com/productcert/html/ssa-970803.html ; SSA-979641 https://cert-portal.siemens.com/productcert/html/ssa-979641.html ; SSA-242944 https://cert-portal.siemens.com/productcert/html/ssa-242944.html ; SSA-724261 https://cert-portal.siemens.com/productcert/html/ssa-724261.html