noindex and left out of the sitemap until more data is confirmed.CVE-2026-63351 is a stored cross-site scripting flaw in the SIMATIC S7-1500 PLC web server's Trace page, triggered by importing a crafted CSV trace file, that lets an attacker who social-engineers an authorized diagnostics user run JavaScript in that user's browser session and perform PLC operations within their authorization scope; NVD has not yet completed its own analysis, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63351 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC S7-1500 CPU family web server (incl. ET 200SP, Software Controller, SIPLUS variants) | — | All versions of the listed SIMATIC S7-1500/ET 200SP/Software Controller/S7-PLCSIM Advanced CPU models; no fixed version published as of 2026-10-22 |
What this means
CVE-2026-63351 is a cross-site scripting vulnerability (CWE-79) in the web server of the Siemens SIMATIC S7-1500 CPU family. NVD's description states that "affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page," and that this "could allow an attacker to social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file," with successful exploitation allowing "attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations through the web server within the scope of the user's authorization" (NVD).
NVD tracks the CVE with status "Awaiting Analysis": the only severity data on record is Siemens' own CNA submission — CVSS v3.1 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and CVSS v4.0 5.3 (medium) — with no NVD-published independent score yet, so this page leaves cvss_score unset rather than presenting that figure as NVD-confirmed (NVD).
Siemens' product security advisory SSA-591731 bundles CVE-2026-63351 with seven related CVEs (CVE-2026-63350, -63352 through -63357) affecting the same SIMATIC S7-1500 web server across a very wide family of CPU models (standard, Fail-safe, Software Controller, ET 200SP, SIPLUS and S7-PLCSIM Advanced variants). CISA's ICS advisory ICSA-26-295-14, republishing that Siemens bulletin on 2026-10-22, lists an overall CVSS v3.1 score of up to 9.6 for the most severe of the eight bundled flaws (CWE-95 eval injection), while this specific CVE is the CWE-79 trace-file XSS scored individually by Siemens at 6.1. The advisory states "currently no fix is available," recommends disabling the web server where not needed, restricting ports 80/tcp and 443/tcp to trusted IP addresses, limiting the "Read diagnostics" right to qualified personnel, and only importing trusted trace files, and reports no known public exploitation (CISA ICS Advisory ICSA-26-295-14).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00187 (8.231th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis and because no fix is currently available for this flaw, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis and a patch are published. In the meantime, operators of affected SIMATIC S7-1500 CPUs should disable the web server where it is not operationally required, restrict management-port access to trusted hosts, and limit who holds the "Read diagnostics" right and can import trace files.
Evidence
- Affected devices fail to sanitize visual properties of calculated signals in imported CSV trace files before rendering them on the web server's Trace page, letting a social-engineered diagnostics user trigger attacker JavaScript and PLC operations (CWE-79). — NVD
- NVD status is "Awaiting Analysis" with Siemens-submitted CVSS v3.1 6.1 and CVSS v4.0 5.3; no NVD-published independent score as of 2026-10-26. — NVD
- Bundled with seven related CVEs in the same SIMATIC S7-1500 web server across a wide range of CPU models; currently no fix is available; mitigations are disabling the web server, restricting ports 80/443 to trusted IPs, limiting the Read-diagnostics right, and only importing trusted trace files; no known public exploitation. — CISA ICS Advisory ICSA-26-295-14
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00187 (8.231th percentile) as of 2026-10-26. — FIRST EPSS
