noindex and left out of the sitemap until more data is confirmed.CVE-2026-63355 is a stored cross-site scripting flaw in the web server built into Siemens SIMATIC S7-1500 PLCs and related controllers: it fails to sanitize signal names from an imported CSV trace file before showing them in a selection menu on the Trace page, so a user with 'Read diagnostics' rights who is social-engineered into importing a crafted trace file ends up running attacker-controlled JavaScript in their own browser session. It is not on CISA's KEV list and NVD still shows it as "Awaiting Analysis" as of 2026-10-28, so this page is pending and the CVSS figures below are Siemens' own CNA submission, not an NVD-confirmed score.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63355 · Source: Siemens (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC S7-1500 CPU family / Drive Controller / ET 200SP Open Controller / S7-1500 Software Controller / S7-PLCSIM Advanced (integrated Web Server) | cpe:2.3:a:siemens:simatic_s7-1500_firmware:*:*:*:*:*:*:*:* | All versions (no fix available as of the 2026-10-13 advisory; mitigation only) |
What this means
CVE-2026-63355 is one of eight related CSV-trace-import cross-site-scripting and eval-injection vulnerabilities (CVE-2026-63350 through CVE-2026-63357) that Siemens disclosed together in advisory SSA-591731 for the web server built into the SIMATIC S7-1500 CPU family and related products. NVD's description for this specific CVE reads: "Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user's browser session when the user subsequently interacts with an affected selection menu" (NVD).
NVD lists the score submitted by the Siemens CNA ([email protected]): CVSS v3.1 6.1 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and CVSS v4.0 5.3 (MEDIUM); CWE-79 (NVD). NVD's own vulnerability-status field reads "Awaiting Analysis" as of 2026-10-28, and the CVE is not on the CISA KEV catalog, so per our indexing policy this page stays noindex with no NVD-confirmed cvss_score; the 6.1/5.3 figures above are Siemens' own submission.
The advisory covers all versions of a wide range of S7-1500-family products — SIMATIC Drive Controller CPU 1504D TF/1507D TF, SIMATIC ET 200SP Open Controller, SIMATIC ET 200SP CPU 1510SP/1512SP/1514SP, the full SIMATIC S7-1500 CPU 1511-1518 range, the S7-1500 Software Controller and S7-PLCSIM Advanced — and Siemens states no fix is currently available. The published mitigation is to disable the controller's web server if it is not required, and, if it must stay enabled, to restrict access to ports 80/tcp and 443/tcp to trusted IP addresses and only import trace files from trusted sources (CISA ICS Advisory ICSA-26-295-14).
The same advisory discloses three sibling CVEs scored materially higher (CVE-2026-63350, -63353, -63354 at CVSS v3.1 9.6, where the injected content is attacker-controlled executable code rather than just a signal name shown in a menu); CVE-2026-63355 is one of the lower-severity variants where the injection point is the signal-name selection menu specifically, requiring the victim to interact with that menu after import.
Exploitation requires social engineering a privileged user into importing a file (UI:R), and neither CISA nor NVD report observed in-the-wild exploitation. As of 2026-10-28, FIRST scores the probability of exploitation at 0.00187 (8.3th percentile), consistent with an unexploited, user-interaction-dependent flaw (FIRST EPSS).
Until a fix ships and NVD completes analysis, operators of the affected S7-1500-family controllers should disable the web server where it is not operationally required and restrict trace-file imports to a controlled, trusted process.
Evidence
- Unsanitized signal names from an imported CSV trace file are rendered in a Trace-page selection menu, allowing attacker-controlled JavaScript execution in the browser session of a socially-engineered user with 'Read diagnostics' rights. — NVD
- CVSS v3.1 6.1 (MEDIUM) and CVSS v4.0 5.3 (MEDIUM), CWE-79, submitted by the Siemens CNA ([email protected]); NVD vulnStatus is Awaiting Analysis as of 2026-10-28. — NVD
- All versions of the SIMATIC S7-1500 CPU family and related controllers are affected; no fix available as of 2026-10-13; mitigation is to disable the web server or restrict port 80/443 access and only import trusted trace files. — CISA ICS Advisory ICSA-26-295-14
- EPSS score is 0.00187 (8.3th percentile) as of 2026-10-28. — FIRST EPSS
