# Siemens SIMATIC S7 .NET Client Library flaws patched

Published: 2026-10-22 · Severity: routine · Sectors: Manufacturing, Transportation, Energy, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/1d3fdffd-fa2e-5a04-9e3a-f3b228b0bce4/siemens-simatic-s7-net-client-library-flaws-patched

> Siemens patched path traversal and information disclosure bugs in its .NET Client Library for SIMATIC S7 Webserver API; update to version 3.3.62 or later.

Siemens disclosed two vulnerabilities in the .NET Client Library for SIMATIC S7 Webserver API affecting versions prior to 3.3.62. The first is a path traversal flaw (CWE-22) that could allow an attacker to write arbitrary files outside the intended download directory. The second involves generation of error messages containing sensitive information, which could expose data to an attacker. Both vulnerabilities carry a CVSS v3 score of 7.5.

The library is used across industries deploying SIMATIC S7 controllers, with CISA noting deployment worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services sectors. Siemens ProductCERT reported these issues to CISA, and no evidence of active exploitation is mentioned in the advisory. Siemens has released an updated version (3.3.62) and recommends all users update immediately. CISA republished the Siemens advisory (SSA-390352) and reiterates standard ICS hardening guidance: minimizing network exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs when necessary.

This is a vendor-patched vulnerability disclosure with no reported in-the-wild exploitation. Defenders using this client library should prioritize patching to version 3.3.62 or later and review network segmentation for SIMATIC S7 deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-85114, CVE-2026-85115

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1d3fdffd-fa2e-5a04-9e3a-f3b228b0bce4/siemens-simatic-s7-net-client-library-flaws-patched.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup