CISA flags critical 9.8 flaw in Siemens RUGGEDCOM APE1808 via Brotli decoder

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has republished Siemens ProductCERT advisory SSA-898633 covering a critical out-of-bounds write affecting the RUGGEDCOM APE1808 running Palo Alto Networks PAN-OS. The flaw sits in the Google Brotli decoder and scores 9.8. For operators of critical manufacturing networks, this is a remote, unauthenticated code-execution risk that the vendor fixes by PAN-OS upgrade.

• CVE-2026-111497 affects all versions of the Siemens RUGGEDCOM APE1808 running Palo Alto Networks PAN-OS and carries a CVSS v3.1 score of 9.8, rated critical.
• The underlying flaw is a buffer overflow in the Google Brotli decoder in versions 1.0.3 through 1.2.0, permitting remote unauthenticated code execution via a crafted Brotli-compressed stream.
• Siemens advises upgrading to the corresponding available PAN-OS version and implementing Palo Alto Networks' upstream workarounds; affected Brotli libraries should move to 1.0.10, 1.1.1 or 1.2.1.
• The advisory is a verbatim CISA republication of Siemens ProductCERT SSA-898633, provided as-is, with CISA disclaiming responsibility for technical accuracy.

Executive summary

CISA on November 12, 2026 republished Siemens ProductCERT advisory SSA-898633 as ICS advisory ICSA-26-316-04, covering a single critical vulnerability in the Siemens RUGGEDCOM APE1808 running Palo Alto Networks PAN-OS. The advisory is a verbatim conversion of the vendor's Common Security…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.