noindex and left out of the sitemap until more data is confirmed.CVE-2026-63352 is a stored cross-site scripting flaw in the web-based Trace page of Siemens SIMATIC S7-1500 PLCs and related controllers: unsanitized calculated signal data from an imported CSV trace file can run attacker-controlled JavaScript in the browser of a user who imports it, but NVD has not yet completed its own CVSS scoring or CPE analysis, so this page is held as noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63352 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC S7-1500 CPU / Drive Controller / ET 200SP Open Controller / S7-1500 Software Controller / S7-PLCSIM Advanced families (incl. SIPLUS variants) | — | All versions, across all 8 CVEs in this advisory (CVE-2026-63350 through CVE-2026-63357); Siemens states no fix is currently available for any of them |
What this means
CVE-2026-63352 (CWE-79, improper neutralization of input during web page generation) is one of eight related vulnerabilities (CVE-2026-63350 through CVE-2026-63357) that Siemens disclosed together in advisory SSA-591731 for the web server built into SIMATIC S7-1500 CPUs and related controller families. For this specific CVE, affected devices "do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page." An attacker would need to social-engineer an authorized user who holds the "Read diagnostics" function right into importing a specially crafted trace file; successful exploitation lets attacker-controlled JavaScript execute in that user's browser session and perform PLC operations through the web server, within the scope of the victim's own authorization (Siemens Security Advisory SSA-591731).
Siemens scores CVE-2026-63352 itself at CVSS v3.1 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and CVSS v4.0 5.3, reflecting that the attack needs user interaction and only affects the browser session's own authorization scope, not the device directly. NVD's own description matches this Siemens text verbatim but the CVE's NVD status is "Awaiting Analysis" as of 2026-10-26: NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score and cpe unset rather than presenting the Siemens-submitted figures as NVD-confirmed (NVD).
All eight CVEs in SSA-591731 affect the same long product list — SIMATIC S7-1500 CPU variants, SIMATIC Drive Controller, SIMATIC ET 200SP Open Controller, SIMATIC S7-1500 Software Controller (V2/V3/V4), SIMATIC S7-PLCSIM Advanced and their SIPLUS-hardened equivalents — "[a]ll versions" of each, and Siemens states "[c]urrently no fix is available" for any of them; recommended mitigations are disabling the webserver where not needed, restricting network access to the relevant ports, and only importing trusted trace files (Siemens Security Advisory SSA-591731; CISA ICS Advisory ICSA-26-295-14).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00187 (8.231th percentile) — consistent with a flaw that requires social engineering and a specific user privilege rather than being remotely, unauthenticatedly exploitable (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis and Siemens has not yet shipped a fix, this page does not yet meet the minimum data bar for indexing. In the meantime, operators of affected SIMATIC S7-1500 controllers should disable the device web server if it is not required, restrict network access to it, and treat imported trace files from untrusted sources with caution.
Evidence
- Unsanitized calculated signal data in imported CSV trace files can execute attacker-controlled JavaScript in the browser of a "Read diagnostics" user who imports a crafted file, enabling PLC operations through the web server (CWE-79). — Siemens Security Advisory SSA-591731
- Siemens scores this CVE at CVSS v3.1 6.1 (medium) / v4.0 5.3; NVD status is "Awaiting Analysis" with no NVD-published score or CPE configuration as of 2026-10-26. — NVD
- All 8 related CVEs (CVE-2026-63350 through CVE-2026-63357) affect all versions of the listed SIMATIC S7-1500 / Drive Controller / ET 200SP Open Controller / Software Controller / PLCSIM Advanced families; currently no fix available. — CISA ICS Advisory ICSA-26-295-14
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00187 (8.231th percentile) as of 2026-10-26. — FIRST EPSS
