Siemens published SSA-591731 on 13 October 2026, covering eight vulnerabilities in the web server built into SIMATIC S7-1500 controllers. If you run a SIMATIC S7-1500, ET 200SP or ET 200pro CPU, a SIMATIC Drive Controller, an S7-1500 Software Controller or S7-PLCSIM Advanced, and the integrated web server is reachable by someone holding the "Read diagnostics" function right, this advisory is addressed to you. Every one of the 157 product entries Siemens lists is affected in all versions, and as of 30 October it still reads "Currently no fix is available" for each.

The vulnerable component is a browser. The impacted component is a controller.

All eight flaws sit in how the web server handles imported trace files on its Trace page. CVE-2026-63350 is eval injection: the device "do[es] not properly restrict executable content contained in imported trace files." The other seven are cross-site scripting in fields rendered without sanitisation, among them trace file comment fields (CVE-2026-63353), visual marker data in imported CSV trace files (CVE-2026-63354) and calculated signal names placed into error messages (CVE-2026-63356). Siemens scores CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354 at CVSS v3.1 9.6, with a CVSS v4.0 score of 9.4, and the remaining five at 6.1.

The mechanism matters more than the numbers. Exploitation needs an attacker to "social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file," after which "attacker-controlled JavaScript [can] execute in the user's browser session and perform PLC operations through the web server within the scope of the user's authorization" (Siemens).

That is why a cross-site scripting bug scores as it does on a PLC. The vector Siemens publishes is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: no attacker privileges on the device, user interaction required, and a scope change. The flaw is in the rendering; the consequence lands on the controller, because that web server is a control interface. CISA republished the advisory as ICSA-26-295-14 on 22 October, listing Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services and Government Services and Facilities. That republication is a verbatim conversion of Siemens' machine-readable advisory and says so.

What this changes if your controllers expose a web server

"Read diagnostics" reads like a view-only right, and taken on its own it is. These flaws do not use it to read anything. They use the person who holds it as the delivery path, and then act with whatever that same session is authorised to do.

So the blast radius is not set by the vulnerability. Siemens bounds the impact to the importing user's own authorisation, so the question for whoever maintains these controllers is not how severe the CVE is but what else the accounts holding "Read diagnostics" can do there. Where that right has been granted alongside write authorisation, a single file import reaches the write half.

The delivery path deserves the same scrutiny. Trace files exist in order to be exchanged: pulled off a controller during commissioning, attached to a vendor support ticket, carried in on a laptop. Siemens' instruction to "[o]nly upload trusted trace files" is a procedural control over a file type whose whole purpose is to travel, often to and from the integrator who asked for it. It reads as trivial and it is not.

The published mitigations cover different ground, worth separating before anyone picks one. Restricting ports 80/tcp and 443/tcp to trusted addresses changes who can reach the web server; it does nothing about a file a legitimate user imports from a legitimate workstation. Limiting access to qualified personnel narrows who can be socially engineered. Disabling the web server is the only one that removes the attack surface rather than narrowing access to it.

For context on why an exposed S7 web interface draws attention at all, the joint advisory AA26-231A from NSA, CISA, FBI, DOE and EPA, published 19 August 2026, lists "S7-1500 Series (all CPU variants, including F-series safety controllers)" among targeted models, reports actors using internet scanning services to find exposed PLCs, and recommends disabling unused web servers as S7-specific hardening. We covered it here. It names no CVE and does not mention SSA-591731, and no source we opened connects that activity to these eight flaws. Siemens' advisory makes no statement about exploitation either way, and none of the eight CVEs appears in CISA's Known Exploited Vulnerabilities catalog as of catalog version 2026.10.29.

What to do if you maintain S7-1500 controllers

Now

  • Before changing anything on a running controller, note the standing reminder CISA attaches to the republication, to "perform proper impact analysis and risk assessment prior to deploying defensive measures" (CISA, revision 2, read 30 October 2026). Switching off a web server that an operations workflow depends on is a change to the process, not only to the device.
  • Scope check: list every SIMATIC S7-1500, ET 200SP and ET 200pro CPU, Drive Controller, S7-1500 Software Controller and S7-PLCSIM Advanced instance you run, and record for each whether the web server is enabled. Siemens lists all 157 product entries as affected in all versions, so there is no version number to compare against (Siemens, V1.0, read 30 October 2026). If that list does not already exist, the asset inventory gap is the first thing to close.
  • Then apply Siemens' mitigations in the order the advisory gives them: "Disable the webserver if not required on the affected systems. Restrict the access to Port 80/tcp and 443/tcp to trusted IP address only"; "Ensure only qualified personnel is authorized to access the web server"; "Only upload trusted trace files" (Siemens).

This week

  • Work through CISA's recommended measures as the republication states them: minimise network exposure for all control system devices and ensure they are not accessible from the internet; locate control system networks and remote devices behind firewalls, isolated from business networks; where remote access is required, use more secure methods such as VPNs, "recognizing VPNs may have vulnerabilities and should be updated to the most recent version available," and that a VPN "is only as secure as its connected devices" (CISA).
  • Our recommendation: review which accounts hold "Read diagnostics" on each device and what else those same accounts may do there, since Siemens ties the impact to the importing user's authorisation (Siemens).

Plan

  • Take the S7-specific hardening in AA26-231A as the longer programme: inventory all Siemens S7 series PLCs including firmware versions and the engineering workstations that reach them, keep PLCs off the internet including blocking TCP port 102 at perimeter firewalls, strengthen access controls, enable logging and ICS-aware intrusion detection, disable unused web servers and protocols, and contact Siemens for model-specific guidance (CISA and partners, 19 August 2026). That advisory addresses exposure of S7 series PLCs generally, not these eight flaws.
  • Configure the surrounding environment to Siemens' operational guidelines for Industrial Security, which the advisory names as its general recommendation.
  • Our recommendation: put a review date on this one. Siemens' machine-readable advisory carries status "interim" and states that it "is preparing fixes," so the fix line is the one to re-check. Monitoring writes to the controller survives either outcome, and it depends on knowing which zones may talk to which, where segmentation is often thinner than network diagrams suggest.

If you cannot patch

There is no patch to apply. As of 30 October 2026 SSA-591731 stands at V1.0 and lists "Currently no fix is available" against every affected product, so the mitigations above are the entire published remediation. Running them while the fix is in preparation is what the advisory's guidance comes to.

If you are not affected

Siemens' preconditions are explicit: the affected products are the entries listed in SSA-591731, and exploitation requires a reachable web server plus an authorized user holding the "Read diagnostics" function right who imports a crafted file. A controller with the web server disabled, or with nobody holding that function right, does not meet them, and there may be nothing further to do. Our recommendation is to record that as mitigated by configuration rather than as not affected, since Siemens still lists the product as affected in all versions and a later commissioning job can switch the interface back on.

Where a controller has no fix, the controls left are knowing which devices expose the interface and watching what they do, which is what our OT security services and managed OT SOC are built around.