noindex and left out of the sitemap until more data is confirmed.CVE-2026-63354 is a stored cross-site-scripting flaw in the web-based Trace diagnostic page of Siemens SIMATIC S7-1500 PLCs and related controllers: an attacker who social-engineers an authorized diagnostics user into importing a crafted CSV trace file can run JavaScript in that user's browser session and perform PLC operations within their authorization, and it is not yet listed in NVD or the CISA KEV catalog, so this page stays noindex until an NVD-confirmed score or KEV listing lands.
Vulnerability summary
N/A
Not yet scored
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63354 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| SIMATIC S7-1500 CPU family (incl. SIPLUS, MFP and ODK variants) | — | All versions — no fix currently available; Siemens is preparing fixes |
| SIMATIC Drive Controller / ET 200SP Open Controller (incl. SIPLUS variants) | — | All versions — no fix currently available; Siemens is preparing fixes |
| SIMATIC S7-1500 Software Controller / S7-PLCSIM Advanced | — | All versions — no fix currently available; Siemens is preparing fixes |
What this means
CVE-2026-63354 is one of eight related vulnerabilities (CVE-2026-63350 through CVE-2026-63357) that Siemens disclosed together in its web server for SIMATIC S7-1500 CPUs and related controllers. NVD's description states: "Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations through the web server within the scope of the user's authorization" (NVD).
This CVE's NVD status is "Awaiting Analysis" as of 2026-10-27, so there is no NVD-published CVSS score. The only CVSS figures on record are Siemens' own CNA-submitted scores, stored by NVD as Secondary (not NVD-confirmed) metrics: CVSS v3.1 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and CVSS v4.0 9.4, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. CWE-79 (Cross-site Scripting) is CNA-assigned (NVD).
Siemens' own ProductCERT advisory SSA-591731 (published 2026-10-13) confirms the identical CVSS v3.1 9.6 / v4.0 9.4 figures for this specific CVE and states the issue affects the SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller (and SIPLUS variants), SIMATIC S7-1500 CPU products (including MFP and ODK variants), the SIMATIC S7-1500 Software Controller, and S7-PLCSIM Advanced — all versions, with every product in the advisory affected by all eight CVEs. The advisory's summary states plainly: "Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available"; as of this page's publication, no fixed version exists for any of the listed products (Siemens ProductCERT Advisory SSA-591731).
Until a fix ships, Siemens' stated mitigations are: disable the web server if it is not required on the affected system; where it must stay enabled, restrict access to ports 80/tcp and 443/tcp to trusted IP addresses only; only import trusted trace files; and ensure only qualified personnel hold the "Read diagnostics" right needed to import trace files at all, on top of Siemens' general operational-security guidance for industrial devices (Siemens ProductCERT Advisory SSA-591731). CISA republished the same eight CVEs as ICSA-26-295-14, affecting the Critical Manufacturing sector worldwide (CISA ICS Advisory ICSA-26-295-14).
CVE-2026-63354 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27. As of the same date, FIRST scores the probability of exploitation at 0.00314 (24.11th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not yet analysed this CVE and no vendor fix exists yet, this page does not meet the minimum data bar for indexing and will be revisited once that data lands. In the meantime, operators running any of the affected SIMATIC S7-1500 products should disable the device web server where it is not required, restrict web ports to trusted IP addresses, limit the "Read diagnostics" right to trusted personnel, and treat imported trace files as untrusted input.
Evidence
- Affected S7-1500 web servers do not validate/sanitize visual marker data in imported CSV trace files before rendering them on the Trace page, letting a social-engineered import run attacker JavaScript in the victim's browser and perform PLC operations within their authorization (CWE-79). — NVD
- NVD status is "Awaiting Analysis" as of 2026-10-27, with no NVD-published CVSS score; the only figures on record are Siemens' own CNA-submitted CVSS v3.1 9.6 and v4.0 9.4, stored as Secondary (not NVD-confirmed) metrics. — NVD
- Confirms CVSS v3.1 9.6 / v4.0 9.4 for this CVE; affects SIMATIC Drive Controller, ET 200SP Open Controller, S7-1500 CPU family (incl. MFP/ODK), S7-1500 Software Controller and S7-PLCSIM Advanced, all versions, all eight CVEs; no fixed version currently exists; mitigations are disabling the web server, restricting ports 80/443 to trusted IPs, only importing trusted trace files, and restricting the Read diagnostics right. — Siemens ProductCERT Advisory SSA-591731
- CISA republished the same eight CVEs as ICSA-26-295-14, affecting the Critical Manufacturing sector worldwide. — CISA ICS Advisory ICSA-26-295-14
- Not present in the CISA KEV catalog as of 2026-10-27; FIRST's EPSS score is 0.00314 (24.11th percentile) as of the same date. — FIRST EPSS
