Is WinCC OA affected by the current Node2Shell vulnerability (CVE-2026-111497)?

Unfortunately, yes.

Siemens is aware of the vulnerability, CVE-2026-111497, referred to as Broccoli2Shell or Node2Shell, in Google's Brotli decoder. An out-of-bounds write can potentially result in a crash, a memory leak or a remote code execution in software which uses a vulnerable version of Brotli.

We are currently evaluating the impact to Siemens products which are affected by CVE-2026-111497. 
Corresponding security advisories (SSA) will be published as soon as findings are progressed.

Siemens is actively working on the remediation of infrastructure.

https://productcert.siemens.com/news/2026/10/28/node2shellbroccoli2shell---vulnerability-in-googles-c-decoder-affecting-nodejs-python--cve-2026-111497/

An updated WinCC OA version will be availible soon with 3.21.7.0 Patch in the middle of November and 3.20.17.1 Hotfix Patch in the coming days.