Node2Shell (CVE-2026-111497), a critical buffer overflow in Google's Brotli decompression library, has now reached industrial products: on 30 October 2026 Siemens published advisories for Industrial Edge management applications and for RUGGEDCOM APE1808 devices running Palo Alto Networks PAN-OS. OT operators should find out where these products and other Brotli-dependent software sit in their environment, apply Siemens' workarounds where no fix exists, and restrict network access to the affected systems now.
What happened
Node2Shell is the name given to CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by Google's open-source compression library in versions 1.0.3 to 1.2.0. According to Siemens, a remote, unauthenticated attacker could send a crafted Brotli-compressed stream to corrupt memory, read sensitive data, cause a denial of service or potentially execute code. Siemens rates it 9.8 under CVSS v3.1 and 9.2 under CVSS v4.0.
Help Net Security reported on 27 October that Node.js disclosed the flaw on 21 October, that the upstream fix had been committed to the Brotli repository months earlier without a release, and that the issue reaches far beyond Node.js, into .NET, Envoy Proxy, Istio, Python HTTP clients, FFmpeg and other software that decompresses untrusted data. The same report says proof-of-concept exploits are public, that the security firm ELLIO observed exploit traffic in the wild, and that CISA has added the CVE to its Known Exploited Vulnerabilities catalogue. Fixed library versions are Brotli 1.0.10, 1.1.1 and 1.2.1.
Two Siemens ProductCERT advisories followed on 30 October:
- SSA-443410 (Industrial Edge). Industrial Edge Hub and Industrial Edge Management Cloud were fixed centrally by Siemens on 28 and 29 October, so no customer action is needed for those services. For seven Industrial Edge Management applications, including the Common Configurator, Databus Configurator, Edge OPC UA Server Configurator, Flow Creator Configurator, Cloud Connector Configurator and Data Flow Monitoring, Siemens says no fix is available yet. Its advice is to uninstall or stop the affected applications and to protect Industrial Edge Management (IEM) instances with a firewall or web application firewall. Siemens notes that if no management applications are installed, no action is required, and that further fixes are in preparation.
- SSA-898633 (RUGGEDCOM APE1808). This ruggedised application platform runs Palo Alto Networks PAN-OS. Siemens directs customers to upgrade to the corresponding fixed PAN-OS release. Palo Alto Networks' own advisory says PA-Series and VM-Series firewalls are only affected when Brotli inspection and TLS/SSL decryption are enabled on the dataplane, that the management interface is not affected, and that PAN-OS 11.1 and 10.2 are not affected. It provides a workaround to disable Brotli encoding and says it is not aware of malicious exploitation of the issue in its products.
Why it matters for OT
Most OT teams do not think of a compression library as part of their attack surface. Node2Shell is a reminder that it is. Brotli sits deep inside web servers, proxies, runtimes and security appliances, and it is triggered simply by processing data that arrives over the network. No credentials or user interaction are required.
The Siemens products involved occupy sensitive positions. Industrial Edge brings data from the shop floor towards IT and cloud systems, and its management applications configure data flows and OPC UA services. A RUGGEDCOM APE1808 hosts a PAN-OS next-generation firewall in a ruggedised form, so it can serve as the boundary control between zones at a substation, plant or field site. A flaw in a device that is meant to enforce segmentation deserves particular care, even where the exploitable configuration is narrow.
There is also a wider lesson. Many OT environments run vendor applications, historians, HMI web clients and edge platforms built on Node.js, .NET or Python. Those components can inherit library flaws long before the vendor publishes an advisory, and patches in OT usually wait for a maintenance window and vendor qualification. Teams that cannot answer "where is Brotli in our estate?" will struggle with the next shared-library vulnerability too. We discussed the same pattern with PHP in our article on PHP2Shell attack paths into industrial networks.
Who should act
- Any organisation running Siemens Industrial Edge Management on premises with management applications installed, common in manufacturing, process industries and energy.
- Operators using RUGGEDCOM APE1808 with PAN-OS, for example at utility, transport or other field sites.
- Any OT operator with Node.js-, .NET- or Python-based applications in the control network or industrial DMZ, including vendor-supplied software that may bundle its own runtime.
For essential and important entities under NIS2 in the EU, and for operators preparing for the UK Cyber Assessment Framework, documented vulnerability handling and asset knowledge are expected outcomes, so the way this advisory is triaged is worth recording as evidence.
What to do now
- Identify affected assets. Check whether Industrial Edge Management is installed on premises and which management applications run on it, and list every RUGGEDCOM APE1808 and its PAN-OS version. Use your OT asset inventory rather than memory.
- Apply Siemens' workarounds for Industrial Edge. Where no fix exists, stop or uninstall the affected management applications, as Siemens recommends, after confirming with operations that no live data flow depends on them. Put IEM behind a firewall or web application firewall and allow access only from known engineering hosts.
- Check the PAN-OS configuration on APE1808 devices. Confirm whether Brotli inspection and TLS/SSL decryption are enabled. If they are, plan the fixed PAN-OS release with Siemens support, and consider Palo Alto's workaround to disable Brotli encoding in the meantime, tested in a change window.
- Restrict network reachability. Make sure management interfaces and edge management services are not reachable from the internet or from broad corporate ranges. Review conduits between the industrial DMZ, edge systems and cloud connectors, and tighten rules to named sources and destinations.
- Ask vendors about embedded runtimes. Request statements from suppliers of HMIs, historians, edge and monitoring software on whether their products bundle Node.js, .NET or a Brotli library, and when fixed builds will be available.
- Watch for signs of attempted exploitation. Review logs on internet-facing web services and reverse proxies in front of OT systems for unexpected crashes, restarts or malformed compressed requests, and keep an eye on CISA's KEV entry and vendor updates.
- Record the decision. Document which assets were affected, which workarounds were applied, residual risk and the planned patch date, so that the decision can be reviewed and audited later.
How OTVista helps
OTVista, an OT security tool in early access, links each vulnerability to the assets and zones it affects, so you can see which edge systems and boundary devices are exposed and track workarounds and patches as remediation tasks with evidence. Our independent practitioners can support OT vulnerability management triage and architecture reviews. If you are not sure where to start, the free OT Security Quick Check gives a short baseline view of your current posture.
Sources: Siemens ProductCERT, SSA-443410: Node2Shell in Industrial Edge Management Applications; Siemens ProductCERT, SSA-898633: Node2Shell in PAN-OS on RUGGEDCOM APE1808; Palo Alto Networks, CVE-2026-111497 security advisory; Help Net Security, Brotli bug reaches far beyond Node.js (CVE-2026-111497)
Topics: Node2Shell, CVE-2026-111497, Siemens Industrial Edge vulnerability, RUGGEDCOM APE1808 PAN-OS, Brotli vulnerability OT, OT vulnerability management