SIEMENS has disclosed eight unpatched flaws in the SIMATIC S7-1500 Web Server, disclosed on 13 October 2026. The vulnerabilities reside in the web server’s Trace page and are linked to improper handling of data in imported trace files, enabling cross-site scripting. Three of the flaws are rated critical with CVSSv3 scores up to 9.4, while five are medium severity. Siemens notes there is no public proof of exploitation at present.
Exploitation requires an attacker to lure an authorised user to upload a malicious trace file and the user must possess the “Read diagnostics” right. If successful, malicious JavaScript runs within the victim’s browser and could allow the attacker to perform PLC operations via the web server within the scope of the user’s privileges.
The report emphasises that these are web-facing risks that could impact production environments since SIMATIC S7-1500 controllers are widely used in manufacturing, food and beverage, and chemical sectors, among others.
Affected products include all versions of SIMATIC S7-1500 CPUs (including F, T, TF, MFP and ODK variants), as well as related ET 200SP/ET 200pro CPUs, SIPLUS versions, and several SIMATIC Drive Controller CPUs and ET 200SP Open Controller CPUs. Siemens has not yet issued fixes but has provided mitigations: disable the web server if not needed, restrict access to ports 80 and 443 to trusted IPs, only upload trusted trace files, and ensure only qualified personnel can access the web server. Operators are advised to keep PLCs off the internet and segment OT networks from office systems.