Siemens SIMATIC S7 PLCs Web Server

Plan PatchCVSS 9.6ICS-CERT ICSA-26-295-14Oct 13, 2026

SiemensManufacturingTransportation

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionRequired

Summary

SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.

What this means

What could happen

Could allow an attacker to inject malicious scripts into management interfaces

Who's at risk

Organizations in manufacturing, transportation using Siemens equipment

How it could be exploited

Attacker on the corporate network or internet could reach this device without any credentials. The attack is straightforward with no special conditions

Exploitability

Unlikely to be exploited - EPSS score 0.4%

Affected products (103)

103 pending

ProductAffected VersionsFix Status

SIMATIC Drive Controller CPU 1504D TFAll versionsNo fix yet

SIMATIC ET 200SP CPU 1512SP-1 PNAll versionsNo fix yet

SIMATIC S7-1500 Software Controller CPU 1508S F V2All versionsNo fix yet

SIMATIC S7-1500 Software Controller CPU 1508S F V3All versionsNo fix yet

SIMATIC S7-1500 Software Controller CPU 1508S F V4All versionsNo fix yet

Remediation & Mitigation

0/3

Do now - compensating controls

0/2

WORKAROUNDDisable the webserver if not required on the affected systems. Restrict the access to Port 80/tcp and 443/tcp to trusted IP address only

WORKAROUNDEnsure only qualified personnel is authorized to access the web server

Long-term hardening

0/1

Only upload trusted trace files

CVEs (8)

CVE-2026-63350 CVE-2026-63351 CVE-2026-63352 CVE-2026-63353 CVE-2026-63354 CVE-2026-63355 CVE-2026-63356 CVE-2026-63357

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/5403a3e3-c3b6-4ffd-aa6e-8ee453c2e52e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.