Siemens SIMATIC S7-1500 Web Server XSS Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Multiple web server vulnerabilities in Siemens SIMATIC S7-1500 PLCs allow XSS-based code execution within an authorized user's browser session.
CISA and Siemens have disclosed eight vulnerabilities (CVE-2026-63350 through CVE-2026-63357) affecting the integrated web server of a very wide range of SIMATIC S7-1500 CPU variants, including Drive Controllers, ET 200SP CPUs, S7-1500 Software Controllers, PLCSIM Advanced, and corresponding SIPLUS ruggedized models. The flaws allow an attacker to execute malicious code within an authorized user's browser session when interacting with the device's web interface, enabling the attacker to perform PLC operations within the scope of that user's permissions — effectively a cross-site scripting style issue that could lead to unauthorized control actions on affected controllers.
Siemens states it is preparing fixes for the affected product line and has issued specific interim mitigations for products where patches are not yet available. The advisory does not indicate active exploitation in the wild; this is a vendor-disclosed vulnerability set affecting an extremely broad catalog of S7-1500 hardware and software controller SKUs used across industrial automation, including Drive Controllers, ET 200SP, and Software Controllers for Linux and Windows.
Defenders operating SIMATIC S7-1500 PLCs should inventory affected CPU models and firmware versions, apply Siemens mitigations immediately where patches are unavailable, restrict network and browser access to PLC web servers to trusted management hosts, and monitor for anomalous web server interactions or unexpected PLC operations initiated via browser sessions. Given the role of these PLCs in industrial control environments, successful exploitation could affect physical process integrity, warranting prioritized patching once Siemens fixes are released.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs