highCVE
Siemens Releases Mitigations for Eight Web Server Vulnerabilities in SIMATIC S7-1500 PLCs
CISA ICS Advisory ICSA-26-295-14 identifies CVE-2026-63350 through CVE-2026-63357 affecting multiple SIMATIC product lines
Cyber.TechVoid1 min read
Key Takeaways
- Eight CVEs (CVE-2026-63350 through CVE-2026-63357) affect Siemens SIMATIC S7-1500 web server components.
- Affected product lines include SIMATIC Drive Controller, SIMATIC ET 200SP CPUs (F-1, F-2, and SPT variants), and SIMATIC S7-1500 CPUs.
- An attacker could execute malicious code in a user's browser session and perform PLC operations within the user's authorization scope.
- Siemens is preparing fixes; mitigations are recommended for products without available patches.
- CISA has issued advisory ICSA-26-295-14; users should apply mitigations and monitor for firmware updates.
Related Security News
highVulnerability
Siemens PSS(R)SINCAL Out-of-Bounds Write Vulnerability Affects Critical Infrastructure
Siemens PSS(R)SINCAL software versions are affected by an out-of-bounds write vulnerability in the integrated WibuKey third-party driver (CVE-2026-84854). The flaw stems from insufficient input validation when calculating kernel buffer size, potentially causing system crashes and adjacent kernel memory modification. The vulnerability only affects PSS SINCAL when configured to use the legacy WibuKey dongle license type. Siemens and CISA advise applying mitigations while updates are prepared.
CISA Advisories1 min read