Siemens Warns of Eight Unpatched SIMATIC S7-1500 Web Server Flaws Rated Up to CVSS 9.4
Do Son 
TL;DR
Siemens disclosed eight Siemens S7-1500 vulnerabilities in the PLC web server on October 13, 2026. Three of them rate critical at CVSS 4.0 score 9.4. No fix exists yet, so Siemens urges customers to apply mitigations now.
- Total: 8 CVEs
- Severity: 3 Critical · 5 Medium
- Actively exploited: None confirmed
- Highest severity: 9.6 (Critical · CVSSv3) — CVE-2026-63350
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Status |
|---|---|---|
| CVE-2026-63350 | 9.6 | Not exploited |
| CVE-2026-63353 | 9.6 | Not exploited |
| CVE-2026-63354 | 9.6 | Not exploited |
| CVE-2026-63351 | 6.1 | Not exploited |
| CVE-2026-63352 | 6.1 | Not exploited |
| CVE-2026-63355 | 6.1 | Not exploited |
| CVE-2026-63356 | 6.1 | Not exploited |
| CVE-2026-63357 | 6.1 | Not exploited |
Why It Matters
SIMATIC S7-1500 controllers run production lines across many sectors. Siemens says these CPUs serve “manufacturing, food and beverages, and chemical industries worldwide.” A compromised controller session could therefore affect physical processes, not just data.
According to Siemens security advisory SSA-591731, the flaws “could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.”
How the Attack Works
All eight bugs sit in the web server’s Trace page. The page fails to properly clean data inside imported trace files before it displays them. This creates a cross-site scripting risk.
An attacker cannot trigger the flaw alone. Instead, they must trick an authorized user into importing a malicious trace file. That user must also hold the “Read diagnostics” function right. If the trick works, attacker-controlled JavaScript runs in the victim’s browser. From there, it can “perform PLC operations through the web server within the scope of the user’s authorization.”
Severity breakdown
- Critical (CVSS 4.0 9.4): CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354.
- Medium (CVSS 4.0 5.3): CVE-2026-63351, CVE-2026-63352, CVE-2026-63355, CVE-2026-63356 and CVE-2026-63357.
Siemens gives the advisory an overall CVSS 3.1 base score of 9.6.
Exploitation status
Siemens does not report exploitation in the wild. Likewise, no public proof-of-concept has been confirmed for these Siemens S7-1500 vulnerabilities.
Affected Versions
Siemens lists all versions of the affected products, and every product is exposed to all eight CVEs. Affected families include:
- SIMATIC S7-1500 CPUs, including F, T, TF, MFP and ODK variants
- Related ET 200SP and ET 200pro CPUs, plus SIPLUS versions
- SIMATIC Drive Controller CPU 1504D TF and CPU 1507D TF
- SIMATIC ET 200SP Open Controller CPU 1515SP PC
The full list appears in the advisory.
Patch and Mitigation Steps
“Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available,” the advisory states. Until fixes arrive, Siemens recommends these steps:
- “Disable the webserver if not required on the affected systems.”
- Restrict access to ports 80/tcp and 443/tcp to trusted IP addresses only.
- “Only upload trusted trace files.”
- Ensure only qualified personnel can access the web server.
Operators should also keep PLCs off the internet and segment OT networks from office systems. Finally, train engineers to treat trace files from unknown sources with caution.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
