{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:34.798Z","products":["siemens"],"actNowTotal":3,"results":[{"query":"siemens","matched":4,"actNow":3,"events":[{"id":"kev-2026-10-14-palo-alto-networks-pan-os","url":"https://securitythreatpulse.com/events/kev-2026-10-14-palo-alto-networks-pan-os","title":"Palo Alto Networks PAN-OS: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 27 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","4 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-0322"],"vendor":"Palo Alto Networks","product":"PAN-OS","affectedProducts":[{"kind":"direct","slug":"paloaltonetworks/panos","vendor":"Palo Alto Networks","product":"PAN-OS","evidence":["kev","cpe"],"vendorKey":"paloaltonetworks","productKey":"panos"},{"kind":"direct","slug":"paloaltonetworks/cloudngfw","vendor":"Palo Alto Networks","product":"Cloud Ngfw","evidence":["cpe"],"vendorKey":"paloaltonetworks","productKey":"cloudngfw"},{"kind":"direct","slug":"paloaltonetworks/prismaaccess","vendor":"Palo Alto Networks","product":"Prisma Access","evidence":["cpe"],"vendorKey":"paloaltonetworks","productKey":"prismaaccess"},{"kind":"direct","slug":"siemens/ruggedcomape1808","vendor":"Siemens","product":"Ruggedcom Ape1808 Firmware","evidence":["cpe"],"vendorKey":"siemens","productKey":"ruggedcomape1808"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","cvss":8.6,"epss":0.0174,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-10-14","kevDueDate":"2026-10-17","firstSeenAt":"2026-10-14T00:00:00.000Z","updatedAt":"2026-11-10T19:31:15.956Z","newestEvidenceAt":"2026-11-05T10:06:28.744Z"},{"id":"kev-2026-09-18-linux-kernel","url":"https://securitythreatpulse.com/events/kev-2026-09-18-linux-kernel","title":"Linux Kernel: 3 memory flaws used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 138 days old, so many systems are likely still unpatched. The severity score is critical (9.8).","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","5 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2025-39682","CVE-2025-39964","CVE-2026-53266"],"vendor":"Linux","product":"Kernel","affectedProducts":[{"kind":"direct","slug":"linux/kernel","vendor":"Linux","product":"Kernel","evidence":["kev"],"vendorKey":"linux","productKey":"kernel"},{"kind":"direct","slug":"linux/linux","vendor":"Linux","product":"Linux","evidence":["cpe"],"vendorKey":"linux","productKey":"linux"},{"kind":"direct","slug":"linux/linuxkernel","vendor":"Linux","product":"Linux kernel","evidence":["cpe"],"vendorKey":"linux","productKey":"linuxkernel"},{"kind":"direct","slug":"siemens/simatics71500cpu15184pndpmfp","vendor":"Siemens","product":"Simatic S7-1500 CPU 1518-4 Pn/dp Mfp Firmware","evidence":["cpe"],"vendorKey":"siemens","productKey":"simatics71500cpu15184pndpmfp"},{"kind":"direct","slug":"siemens/simatics71500cpu1518f4pndpmfp","vendor":"Siemens","product":"Simatic S7-1500 CPU 1518f-4 Pn/dp Mfp Firmware","evidence":["cpe"],"vendorKey":"siemens","productKey":"simatics71500cpu1518f4pndpmfp"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions.","cvss":9.8,"epss":0.03312,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-18","kevDueDate":"2026-09-21","firstSeenAt":"2026-09-18T00:00:00.000Z","updatedAt":"2026-11-10T13:30:21.882Z","newestEvidenceAt":"2026-11-10T10:10:01.886Z"},{"id":"kev-2026-10-20-siemens-software-center","url":"https://securitythreatpulse.com/events/kev-2026-10-20-siemens-software-center","title":"Siemens Software Center: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 26 days old, so many systems are likely still unpatched.","tier":"now","rankScore":3,"rankWhy":["Exploitation is confirmed by an authoritative source."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-110936"],"vendor":"Siemens","product":"Software Center","affectedProducts":[{"kind":"direct","slug":"siemens/softwarecenter","vendor":"Siemens","product":"Software Center","evidence":["kev"],"vendorKey":"siemens","productKey":"softwarecenter"},{"kind":"direct","slug":"siemens/siemenssoftwarecenter","vendor":"Siemens","product":"Siemens Software Center","evidence":["cpe"],"vendorKey":"siemens","productKey":"siemenssoftwarecenter"}],"category":{"id":"business-app","label":"Business software","why":"It runs day-to-day business work such as finance, printing, phones or manufacturing.","doThis":"Ask the vendor or the team that owns it whether the fix is in."},"summary":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","cvss":8.4,"epss":0.00967,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-10-20","kevDueDate":"2026-11-03","firstSeenAt":"2026-10-20T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-10-21T22:56:17.000Z"},{"id":"early-cve-2026-58115","url":"https://securitythreatpulse.com/events/early-cve-2026-58115","title":"Siemens SIMATIC IoT2050 Advanced: attackers can run their own code","verdict":"watch","verdictReason":"Attacks are reported but not confirmed by an authoritative source, and the vulnerability is more than 90 days old.","tier":null,"rankScore":3,"rankWhy":["Exploitation is reported.","The first report is 8 days old.","5 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-58115"],"vendor":"Siemens","product":"SIMATIC IoT2050 Advanced","affectedProducts":[{"kind":"direct","slug":"siemens/simaticiot2050advanced","vendor":"Siemens","product":"SIMATIC IoT2050 Advanced","evidence":["cna"],"vendorKey":"siemens","productKey":"simaticiot2050advanced"},{"kind":"direct","slug":"siemens/simaticiot2050advanced6es76470ba001ya2","vendor":"Siemens","product":"Simatic Iot2050 Advanced (6es7647-0ba00-1ya2)","evidence":["cpe"],"vendorKey":"siemens","productKey":"simaticiot2050advanced6es76470ba001ya2"},{"kind":"direct","slug":"siemens/simaticiot2050basic6es76470ba000ya2","vendor":"Siemens","product":"Simatic Iot2050 Basic (6es7647-0ba00-0ya2)","evidence":["cpe"],"vendorKey":"siemens","productKey":"simaticiot2050basic6es76470ba000ya2"},{"kind":"direct","slug":"siemens/simaticiot2050m26es76470bb001ya2","vendor":"Siemens","product":"Simatic Iot2050 M.2 (6es7647-0bb00-1ya2)","evidence":["cpe"],"vendorKey":"siemens","productKey":"simaticiot2050m26es76470bb001ya2"},{"kind":"direct","slug":"siemens/simaticiot2050sm6es76470ca001aa2","vendor":"Siemens","product":"Simatic Iot2050 Sm (6es7647-0ca00-1aa2)","evidence":["cpe"],"vendorKey":"siemens","productKey":"simaticiot2050sm6es76470ca001aa2"}],"category":{"id":"business-app","label":"Business software","why":"It runs day-to-day business work such as finance, printing, phones or manufacturing.","doThis":"Ask the vendor or the team that owns it whether the fix is in."},"summary":"A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are capable of executing system commands on the server.","cvss":10,"epss":0.0089,"exploitMaturity":"poc","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-03T08:09:54.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-09T11:53:28.323Z"}]}]}