Siemens SIMATIC S7 PLCs Web Server Vulnerabilities

Siemens SIMATIC S7

Siemens SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations.

Do this now

Restrict access to the S7-1500 web server and disable it if unused until a vendor fix is available.

First seen: 22 Oct 2026
Last update: 22 Oct 2026, 12:00 UTC
Identifiers: CVE-2026-63350
CVE-2026-63351
CVE-2026-63352
CVE-2026-63353
CVE-2026-63354
CVE-2026-63355
CVE-2026-63356
CVE-2026-63357
CVSS: 9.6
Source: news
On the menu as: Industrial & OT

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Siemens SIMATIC S7 PLCs Web Server Vulnerabilities
Severity: critical. Patch status: no fix yet.
Affected: Siemens SIMATIC S7
Ids: CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356, CVE-2026-63357

Siemens SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations.

## Steps
1. Search the repo, its CI and infra config for Siemens SIMATIC S7. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: Siemens SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-63350") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
https://pwned.coffee/i/siemens-simatic-s7-plcs-web-server-vulnerabilities

Receipt

Exploitation: No known exploitation
Fix: Disable the webserver if not required on the affected systems.
Score: CVSS 9.6 (critical). CVSS 3.1 9.6 (CNA siemens) for CVE-2026-63350
Last checked: 24 Oct 2026, 17:17 UTC

Sources: KEV – CVE record ✓ Vendor –

Sources

cisa.gov: Siemens SIMATIC S7 PLCs Web Server

Totalone very hot coffee