noindex and left out of the sitemap until more data is confirmed.CVE-2026-63353 is a stored cross-site scripting flaw (CWE-79) in the web server built into Siemens SIMATIC S7-1500 CPUs and related controllers: the web server fails to sanitize comment fields inside imported diagnostic trace files, so an attacker who tricks an authorized user into importing a crafted trace file can run arbitrary JavaScript in that user's browser session and carry out PLC operations with that user's privileges; NVD has not yet published its own analysis, so this page stays noindex until that analysis lands.
Vulnerability summary
N/A
Not yet scored
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63353 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC S7-1500 CPU family web server (incl. ET 200SP Open Controller, Drive Controller CPU 1504D/1507D TF, SIPLUS variants, S7-PLCSIM Advanced) | — | All versions — Siemens has not yet released a fix and states it is preparing one |
What this means
CVE-2026-63353 affects the integrated web server of Siemens' SIMATIC S7-1500 CPU family — including the ET 200SP Open Controller, the SIMATIC Drive Controller CPUs 1504D/1507D TF, several SIPLUS ruggedized variants, and the S7-PLCSIM Advanced simulation software. NVD's description states that "affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations through the web server within the scope of the user's authorization" (NVD).
NVD's status for this CVE is "Awaiting Analysis" as of 2026-10-27, so there is no NVD-published CVSS score yet. The only severity figures on record are Siemens' own CNA submission: CVSS v3.1 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — these are the vendor's scores, not NVD-confirmed, and this page leaves cvss_score unset rather than present them as NVD's own figure (NVD).
Siemens' own security advisory SSA-591731 (published 2026-10-13) confirms the same description and CWE-79 classification, lists over 150 affected SIMATIC S7-1500, ET 200SP, Drive Controller, SIPLUS and S7-PLCSIM Advanced product variants as vulnerable in all versions, and states "Siemens recommends specific countermeasures until fixes are available": disable the web server if it is not needed, restrict access to ports 80/tcp and 443/tcp to trusted IP addresses, ensure only qualified personnel can access the web interface, and only import trace files from trusted sources (Siemens Security Advisory SSA-591731).
CISA republished the same advisory as ICSA-26-295-14 on 2026-10-22, affecting Critical Manufacturing sector deployments worldwide, repeating the same interim mitigations and noting that Siemens is preparing fixes (CISA ICS Advisory ICSA-26-295-14).
CVE-2026-63353 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00314 (24.11th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of affected SIMATIC S7-1500 family devices should disable the web server where it is not required, restrict network access to ports 80/443 to trusted hosts, and only allow trace files from trusted sources to be imported.
Evidence
- Unsanitized comment fields in imported trace files let a crafted trace file execute attacker-controlled JavaScript in an authorized user's browser session, enabling PLC operations within that user's authorization (CWE-79). — NVD
- NVD status is "Awaiting Analysis" as of 2026-10-27; only Siemens CNA scores exist: CVSS v3.1 9.6 (critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and CVSS v4.0 9.4 — not NVD-published. — NVD
- Affects over 150 SIMATIC S7-1500/ET 200SP/Drive Controller/SIPLUS/S7-PLCSIM Advanced product variants, all versions, no fix yet; interim mitigation is disabling the web server or restricting port 80/443 access and only importing trusted trace files. — Siemens Security Advisory SSA-591731
- Republished by CISA as ICSA-26-295-14 on 2026-10-22, affecting Critical Manufacturing sector deployments worldwide. — CISA ICS Advisory ICSA-26-295-14
- Not present in the CISA KEV catalog as of 2026-10-27; EPSS score is 0.00314 (24.11th percentile) as of 2026-10-27. — FIRST EPSS
