Siemens has issued two security notices for Teamcenter. For the Brotli vulnerability (CVE-2026-111497), Siemens is still working on patches, so immediate mitigation measures are the way to go for now. For the login vulnerability (CVE-2026-58113), updates are available. This post explains who is affected and what you should do now.
The two vulnerabilities at a glance
| Brotli vulnerability | Login vulnerability | |
| Identifier | CVE-2026-111497 | CVE-2026-58113 |
| Type | Memory error when decompressing Brotli data | Reflected cross-site scripting in the login flow |
| Possible impact | Remote code execution | Reading data and performing actions within the user session |
| Affected | V2412, V2506, V2512, V2606 (and older versions) | V2412, V2506, V2512, V2606 below certain builds |
| Status | Patches in progress | Updates available |
| Action | Coordinate immediate mitigation | Plan the update |
1. The Brotli vulnerability (CVE-2026-111497)
What is Brotli? Brotli is a compression method developed by Google that reduces the size of data for transmission. It works similarly to ZIP but is designed specifically for web content. When the data is received, it is unpacked again. That is exactly where the flaw lies.
What happened? In the Brotli decoder, an attacker can use crafted data to write to memory outside its intended bounds. This can enable remote code execution. Node.js fixed the flaw on 21 October 2026 and rates it “high”; it has also become known as “Node2Shell”. Many products that use Brotli are affected, including .NET. On 27 October 2026, the US agency CISA added the vulnerability to its catalog of actively exploited vulnerabilities, and public proof-of-concept code is available.
What does this mean for Teamcenter? According to Siemens, Teamcenter is affected because it ships with both Node.js and .NET runtimes.
| Version | Status according to Siemens |
| V2412, V2506, V2512, V2606 | Patches in progress, target builds: 2412.0015, 2506.0012, 2512.2611, 2606.2611 (no release date yet) |
| V2612 | Fix already included |
| Versions out of support | Immediate mitigation measures only |
Immediate mitigation measures named by Siemens:
- Disable Brotli decoding
- Block incoming Brotli-compressed requests and responses at the reverse proxy, API gateway, or via edge/WAF rules
Siemens also notes that it may be possible to replace the Node.js and .NET runtime libraries. Since 3 November 2026, Siemens has provided a detailed guide for this (Teamcenter_NodeJS_Patching_Guide) in the Support Center.
What applies to older versions? For versions out of support, Siemens currently names only the immediate mitigation measures. If your Teamcenter version uses an unpatched Node.js release (for example 16, 18, or 20), the instructions for upgrading to Node.js 22, 24, or 26 cannot be applied. For customers on extended maintenance, Siemens asks that a problem report (PR) be filed. For a comprehensive solution, Siemens recommends upgrading to the latest Teamcenter version.
And if Teamcenter is not accessible from the internet? Check the measures anyway. An attack can also originate from within the corporate network. Which measure is right for you depends on your system environment. Please coordinate with your IT team.
2. The login vulnerability (CVE-2026-58113)
In Teamcenter’s login redirect, inputs are not encoded correctly. As a result, an attacker without an account can use a crafted link to inject malicious code into the browser session of a logged-in user (reflected cross-site scripting). The vulnerability was reported by the security firm Bishop Fox, Siemens described it in advisory SSA-157465, and CISA published it as ICSA-26-258-07 on 15 September 2026.
According to the advisory, an attacker can read data or perform actions on the user’s behalf within the session, in each case within that user’s permissions. Siemens rates the vulnerability at CVSS 6.1 (Medium, CVSS 3.1) and 8.5 (High, CVSS 4.0). Updates have been available since September:
| Version | Affected below build | Update to |
| V2412 | below V2412.0013 | V2412.0013 or later |
| V2506 | below V2506.0010 | V2506.0010 or later |
| V2512 | below V2512.2607 | V2512.2607 or later |
| V2606 | below V2606.2607 | V2606.2607 or later |
What you should do now
- Take inventory: Which Teamcenter versions and which Node.js releases are running in production, test, and training?
- Brotli: Coordinate immediate mitigation measures with your IT team until Siemens releases the patches.
- Login vulnerability: Plan the update to the appropriate build.
- Bundle updates: Once the Brotli patches are released, maintenance windows and testing can be combined.
- Raise user awareness: Do not open Teamcenter links from unexpected emails or messages.
How DRWE can help
As a Siemens partner for Teamcenter, we support mid-sized companies with inventory, risk assessment, and updates. For a quick assessment, our Quick Support (1–4 hours) is a good fit. You can find more about our services under Teamcenter Consulting and PLM Consulting.
Not sure where your environment stands? Write to us at kontakt@drwe.de or call +49 (0) 7031 4103090 (Mon–Thu 9 a.m.–5 p.m., Fri 9 a.m.–3 p.m. CET).
Frequently asked questions
A memory error when decompressing Brotli-compressed data. It affects many products, including Teamcenter, because it ships with Node.js and .NET runtimes, and it can enable remote code execution.
Not yet. Siemens is working on patches for V2412, V2506, V2512, and V2606 and names target builds, but no release date. V2612 already includes the fix. Until then, Siemens’ immediate mitigation measures help.
Disable Brotli decoding, or block Brotli-compressed requests and responses at the reverse proxy, API gateway, or via edge/WAF rules. A detailed Siemens guide on the Node.js libraries has been available in the Support Center since 3 November 2026.
For versions out of support, Siemens currently names only the immediate mitigation measures. For extended maintenance, a problem report must be filed. For a comprehensive solution, Siemens recommends upgrading to the latest version.
Siemens recommends updating to the fixed builds. Since they have been available since September, you should plan the update promptly.
In the Siemens Support Center (article PL8869204 on the Brotli vulnerability) and in the CISA advisory ICSA-26-258-07 on the login vulnerability.
Sources
- Siemens Support Center: PL8869204, Updated Statement zu CVE-2026-111497 (as of 4 November 2026)
- CISA: ICSA-26-258-07 Siemens Teamcenter
- Siemens Support Center: Teamcenter Downloads
- Siemens ProductCERT: SSA-157465
- Help Net Security: Brotli bug reaches far beyond Node.js
- BleepingComputer: CISA warns of hackers now exploiting critical Node2Shell flaw