CISA republishes Siemens advisory on PAN-OS flaws affecting RUGGEDCOM APE1808

CISA republished a Siemens ProductCERT advisory on July 21 warning that Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW is affected by three PAN-OS vulnerabilities, according to the agency’s industrial control systems notice.

CISA said the notice is a verbatim republication of Siemens ProductCERT SSA-104023 and points users to vendor fix guidance and mitigation steps.

What happened

The advisory says the affected product is Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW, with affected versions listed as all/*.

CISA said Palo Alto Networks published information on PAN-OS vulnerabilities and that Siemens industrial products are affected. The notice identifies three issues: CVE-2026-0266, a cross-site scripting flaw; CVE-2026-0272, a privilege escalation issue tied to missing authorization; and CVE-2026-0273, a command injection flaw.

According to the advisory, CVE-2026-0266 affects a malicious authenticated administrator using the web interface. CVE-2026-0272 allows an authenticated administrator with CLI access to perform actions with root privileges. CVE-2026-0273 allows an authenticated administrator to bypass restrictions and run arbitrary commands as root, with CLI or Web UI access required.

What the advisory says

The advisory says the vulnerabilities apply to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, including virtual and M-Series deployments. CISA said Cloud NGFW and Prisma Access are not affected by the three issues.

The published CVSS v3.1 base scores are 2.4 for CVE-2026-0266, 6.5 for CVE-2026-0272 and 7.2 for CVE-2026-0273. In the advisory’s summary table, the Siemens equipment entry carries a CVSS v3 score of 7.2 and lists cross-site scripting, missing authorization and OS command injection.

Context and background

The advisory places the affected equipment in the critical manufacturing sector and says the deployment area is worldwide. It also lists Germany as the company headquarters location.

CISA’s notice says the document is a direct conversion of Siemens ProductCERT’s CSAF advisory and that Siemens ProductCERT reported the vulnerabilities to CISA. The initial release date in the advisory is July 14, with CISA’s republication dated July 21.

Remediation

The advisory says remediation for each vulnerability is a vendor fix, and users should contact customer support for patch and update information.

Siemens also directs users to protect network access to devices and to follow its Industrial Security operational guidelines and product manuals, according to the notice and the company materials cited in it.

CISA recommends minimizing network exposure, isolating control system networks behind firewalls, using secure remote access methods such as VPNs, keeping VPNs updated and reporting suspected malicious activity through internal procedures and to CISA.

Next steps

Users of the affected Siemens product are advised in the notice to review vendor guidance, apply fixes when available and follow the mitigation steps listed by CISA and Siemens.

Because the advisory says remediation comes from the vendor, the next step for affected operators is to contact customer support for patch and update information.

Sources

• CISA advisory page
• CISA CSAF republished content
• Palo Alto Networks security portal
• Palo Alto Networks management access guidance
• CVE-2026-0266 record
• CVE-2026-0272 record
• CVE-2026-0273 record
• Siemens Industrial Security guidelines
• Siemens Industrial Security page
• Siemens ProductCERT advisories contact page
• Siemens terms of use
• CISA notification
• CISA privacy policy

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.