Is CVE-2026-63354 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-63354

Siemens is preparing fixes. Users should apply vendor-recommended mitigations for products where fixes are not yet available and monitor for firmware updates. Specific mitigation guidance should be obtained from Siemens security advisories.

Quick answers

What is CVE-2026-63354?: Siemens is preparing fixes. Users should apply vendor-recommended mitigations for products where fixes are not yet available and monitor for firmware updates. Specific mitigation guidance should be obtained from Siemens security advisories.
How severe is CVE-2026-63354?: high
Is CVE-2026-63354 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-63354 be mitigated?: Siemens is preparing fixes. Users should apply vendor-recommended mitigations for products where fixes are not yet available and monitor for firmware updates. Specific mitigation guidance should be obtained from Siemens security advisories.

CVSS

—

Vendor

Siemens

Published

Oct 23, 2026 · 05:17

Patch

Unknown / not confirmed

Affected products

SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0), SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0), SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0), SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0), SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0), SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0), SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0), SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0), SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0), SIMATIC ET 200SP CPU 1514SP-2 PN (6ES7514-2DN03-0AB0), SIMATIC ET 200SP CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0), SIMATIC ET 200SP CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS, SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs, SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0), SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0)

Mitigation

Siemens Releases Mitigations for Eight Web Server Vulnerabilities in SIMATIC S7-1500 PLCs

Siemens SIMATIC S7-1500 programmable logic controllers and related controllers contain multiple vulnerabilities in the web server component. An attacker could exploit these weaknesses to execute malicious code in an authorized user's browser session and perform PLC operations within the scope of that user's authorization. CISA has issued advisory ICSA-26-295-14, listing eight CVEs (CVE-2026-63350 through CVE-2026-63357) affecting numerous SIMATIC S7-1500, Drive Controller, and ET 200SP variants. Siemens states that fixes are being prepared and recommends specific mitigations for products where fixes are not yet available.

11m

CVE-2026-63354

Quick answers

Related News

Siemens Releases Mitigations for Eight Web Server Vulnerabilities in SIMATIC S7-1500 PLCs