noindex and left out of the sitemap until more data is confirmed.CVE-2026-63350 is an eval-injection flaw in the web server shared by more than 200 Siemens SIMATIC S7-1500-family controllers and related products: importing a specially crafted trace file lets attacker-controlled JavaScript run in the browser session of a user who holds the 'Read diagnostics' right, letting the attacker perform PLC operations within that user's authorization — Siemens has no fix available for any affected product, and NVD has not yet completed its own CVSS scoring, so this page is held as noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63350 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC S7-1500 CPU family web server (and related controllers) | — | All versions of 200+ affected product variants, including SIMATIC Drive Controller CPU 1504D/1507D TF, SIMATIC ET 200SP (Open Controller and F/non-F CPUs), the SIMATIC S7-1500 CPU 1511-1518 family, SIMATIC S7-1500 Software Controller V2-V4, and SIMATIC S7-PLCSIM Advanced; no fix available for any affected product as of 2026-10-13. Not yet a published NVD CPE applicability statement. |
What this means
CVE-2026-63350 (CWE-95, improper neutralization of directives in dynamically evaluated code / eval injection) affects the web server built into Siemens' SIMATIC S7-1500 CPU family and several related controllers. NVD's description, drawn from Siemens' own CVE record, states: "Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations through the web server within the scope of the user's authorization" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-23: it records Siemens' own CVSS v3.1 submission of 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and a CVSS v4.0 score of 9.4, but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting Siemens' figure as NVD-confirmed (NVD).
Siemens' Security Advisory SSA-591731, published 2026-10-13, bundles CVE-2026-63350 with seven further web-server vulnerabilities (CVE-2026-63351, CVE-2026-63352, CVE-2026-63355, CVE-2026-63356 and CVE-2026-63357, five reflected/stored cross-site-scripting issues scored 6.1, plus two further 9.6-scored issues, CVE-2026-63353 and CVE-2026-63354) across more than 200 affected product variants including the SIMATIC Drive Controller, ET 200SP Open Controller, S7-1500 CPU 1511-1518 family, S7-1500 Software Controller and S7-PLCSIM Advanced. No fix is currently available for any of them; Siemens recommends disabling the web server where not operationally required, restricting ports 80/443 to trusted IP addresses, limiting access to qualified personnel, and only importing trusted trace files (Siemens Security Advisory SSA-591731).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-23, and FIRST scores the probability of exploitation at 0.00413 (34.457th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis — and because no vendor fix exists yet — this page does not yet meet the minimum data bar for indexing and will be revisited once a patch and NVD analysis are available. In the meantime, operators of affected SIMATIC web servers should apply Siemens' network-isolation mitigations and restrict trace-file imports to trusted sources.
Evidence
- Importing a crafted trace file lets attacker-controlled JavaScript run in the browser session of a user with the 'Read diagnostics' right, enabling PLC operations within that user's authorization (CWE-95). — NVD
- NVD status is "Awaiting Analysis" with Siemens-submitted CVSS v3.1 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4; no NVD-published score or CPE configuration as of 2026-10-23. — NVD
- Bundled with seven further web-server CVEs (CVE-2026-63351 through CVE-2026-63357) across 200+ affected product variants; no fix available for any of them as of 2026-10-13. — Siemens Security Advisory SSA-591731
- Not present in the CISA KEV catalog as of 2026-10-23. — CISA KEV
- EPSS score is 0.00413 (34.457th percentile) as of 2026-10-23. — FIRST EPSS
