Siemens SSA-591731: eight flaws in the SIMATIC S7-1500 PLC web server's Trace page (CVSS 3.1 up to 9.6) can let a crafted trace file, imported by a user with 'Read diagnostics' rights, run attacker JavaScript and perform PLC operations in that user's session; no fix yet

Vulnerability

Published 2026-10-13 New

Verified 2026-10-25

Siemens SSA-591731: eight flaws in the SIMATIC S7-1500 PLC web server's Trace page (CVSS 3.1 up to 9.6) can let a crafted trace file, imported by a user with 'Read diagnostics' rights, run attacker JavaScript and perform PLC operations in that user's session; no fix yet

Siemens ProductCERT published advisory SSA-591731 on 13 October 2026 for eight vulnerabilities (CVE-2026-63350 to CVE-2026-63357) in the web server of SIMATIC S7-1500 devices.

Siemens says affected devices do not properly validate or sanitise content in imported trace files (including calculated signals in CSV trace files) before rendering it on the web server's Trace page, so an attacker could social engineer an authorised user who holds the function right 'Read diagnostics' into importing a specially crafted file; successful exploitation could let attacker-controlled JavaScript run in the user's browser session and perform PLC operations through the web server within the scope of that user's authorisation. Siemens rates three of the flaws (CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354) CVSS 3.1 9.6 / CVSS 4.0 9.4 and the other five CVSS 3.1 6.1 / CVSS 4.0 5.3.

Siemens lists all versions of the affected products, including S7-1500 CPUs (with related ET 200 CPUs and SIPLUS variants), S7-1500 MFP and ODK CPUs, the S7-1500 Software Controller, ET 200SP Open Controller, SIMATIC Drive Controllers and S7-PLCSIM Advanced, and says 'Currently no fix is available' for each; it says it is preparing fixes and recommends mitigations in the meantime.

CISA republished the advisory on 22 October 2026 as ICSA-26-295-14. Primary: Siemens ProductCERT SSA-591731 (V1.0, 13 Oct 2026); Siemens' advisory, as republished by CISA (22 Oct 2026).

Product

Siemens SIMATIC S7-1500 PLC web server (S7-1500 CPUs incl. related ET 200 CPUs and SIPLUS variants, S7-1500 MFP/ODK CPUs, S7-1500 Software Controller, ET 200SP Open Controller, SIMATIC Drive Controller, S7-PLCSIM Advanced)

Versions

All versions of the listed products are affected; Siemens says 'Currently no fix is available' for every listed product (as of 25 Oct 2026, SSA-591731 V1.0).

CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AVAttack Vector: Network
ACAttack Complexity: Low
PRPrivileges Required: None
UIUser Interaction: Required
SScope: Changed
CConfidentiality: High
IIntegrity: High
AAvailability: High

(CVSS 3.1) / 9.4 (CVSS 4.0), Siemens — highest of eight; five rated 6.1 / 5.3

Exploited in Australia?

unknown

Patch to

No fixed version yet (as of 25 Oct 2026). Siemens' mitigations: disable the web server if it is not required; restrict access to ports 80/tcp and 443/tcp to trusted IP addresses only; only upload trusted trace files; and make sure only qualified personnel are authorised to access the web server. Siemens also recommends protecting network access to the devices in line with its operational guidelines for Industrial Security. Watch SSA-591731 for fixed versions.

vulnerabilities ot ics