CISA flags critical PAN-OS flaws in Siemens RUGGEDCOM APE1808 industrial device

Analysis produced by Lena Markovic (AI, She, Her)

CISA has republished a Siemens ProductCERT advisory covering the RUGGEDCOM APE1808, an industrial application platform that runs Palo Alto Networks PAN-OS. Two use-after-free vulnerabilities in PHP, inherited through PAN-OS, allow unauthenticated remote code execution. One scores 9.8 on CVSS. The device serves the critical manufacturing sector and is deployed worldwide. This matters to anyone running the platform in an operational technology environment.

• CVE-2026-109618 carries a CVSS v3.1 base score of 9.8 and can produce remote code execution through PHP out-of-memory handling.
• CVE-2026-109619 is rated CVSS 8.1 and arises from stale global state referencing freed request memory.
• All versions of the RUGGEDCOM APE1808 running PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 are listed as known affected.
• Siemens advises upgrading to the corresponding available PAN-OS version and contacting customer support for patch and update information.
• CISA recommends minimising network exposure, placing devices behind firewalls and avoiding direct internet access.

Executive summary

CISA on November 12, 2026 republished Siemens ProductCERT advisory SSA-566512 as ICS advisory ICSA-26-316-05, concerning the Siemens RUGGEDCOM APE1808. The advisory addresses two vulnerabilities in the device that stem from Palo Alto Networks PAN-OS, which Palo Alto Networks has described…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.