noindex and left out of the sitemap until more data is confirmed.CVE-2026-63356 is a stored cross-site scripting flaw in the web server built into Siemens SIMATIC S7-1500 PLCs and related controllers: it fails to sanitize calculated signal names from an imported CSV trace file before showing them in an error message on the Trace page, so a user with 'Read diagnostics' rights who is social-engineered into importing a crafted trace file ends up running attacker-controlled JavaScript in their own browser session. It is not on CISA's KEV list and NVD still shows it as "Awaiting Analysis" as of 2026-10-28, so this page is pending and the 6.1/5.3 figures below are Siemens' own CNA submission, not an NVD-confirmed score.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-13
Published
Vulnerability ID: CVE-2026-63356 · Source: Siemens (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SIMATIC S7-1500 CPU family web server (and related SIPLUS/ET 200SP/S7-1500 Software Controller/S7-PLCSIM Advanced variants) | cpe:2.3:a:siemens:simatic_s7-1500_firmware:*:*:*:*:*:*:*:* | all versions (no fix available) |
What this means
CVE-2026-63356 is a cross-site scripting vulnerability (CWE-79) in the web server embedded in Siemens SIMATIC S7-1500 CPUs and related controllers. NVD's description, sourced from the Siemens CNA, states: "Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right 'Read diagnostics' into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user's browser session when the resulting error message is displayed" (NVD).
Siemens' own PSIRT advisory SSA-591731 lists the score it submitted: CVSS v3.1 6.1 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and CVSS v4.0 5.3 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (Siemens PSIRT Advisory SSA-591731). NVD's own vulnerability-status field still reads "Awaiting Analysis" as of 2026-10-28, so NVD has not published an independent score, and the CVE is not on the CISA KEV catalog. Per our indexing policy, this page therefore stays noindex with no NVD-confirmed cvss_score; the figures above are Siemens' own submission, not NVD's.
SSA-591731 is a bundle advisory covering eight related web-server CVEs in the same S7-1500 Trace-page code path (CVE-2026-63350 through CVE-2026-63357); the most severe, CVE-2026-63350, scores 9.6 (CRITICAL) as an eval-injection flaw (CWE-95), while CVE-2026-63356 is one of six lower-severity stored-XSS variants (CWE-79) that share the same trace-import trigger (Siemens PSIRT Advisory SSA-591731). CISA republished the same advisory as ICSA-26-295-14 on 2026-10-22, affecting an extensive list of SIMATIC S7-1500 CPU variants, the SIMATIC Drive Controller, ET 200SP Open Controller, S7-1500 Software Controller and S7-PLCSIM Advanced, in all cases across all versions (CISA ICS Advisory ICSA-26-295-14). No fix is currently available for any of the eight CVEs in this bundle; Siemens recommends deactivating the web server when it is not required, restricting ports 80/tcp and 443/tcp to trusted hosts, limiting the 'Read diagnostics' right to trusted personnel, and treating imported trace files as untrusted input.
Exploitation requires social-engineering an authorized user into importing a file (UI:R/UI:P), and neither Siemens nor CISA report observed in-the-wild exploitation. As of 2026-10-28, FIRST scores the probability of exploitation at 0.00187 (8.3th percentile), consistent with a local-interaction-required flaw with no known active exploitation (FIRST EPSS).
Until NVD completes analysis, treat the 6.1/5.3 figures as indicative only. Sites running affected SIMATIC S7-1500 controllers should disable the PLC web server where it is not operationally required and restrict who can import trace files and who holds the 'Read diagnostics' right.
Evidence
- SIMATIC S7-1500 web server does not sanitize signal names from imported CSV trace files before displaying them in Trace-page error messages, letting a social-engineered import run attacker JavaScript in the victim's browser session. — NVD
- CVSS v3.1 6.1 (MEDIUM) and v4.0 5.3 (MEDIUM), both submitted by the Siemens CNA; NVD vulnStatus is Awaiting Analysis as of 2026-10-28. — Siemens PSIRT Advisory SSA-591731
- SSA-591731 bundles eight S7-1500 web-server CVEs (CVE-2026-63350 through CVE-2026-63357) in the same trace-import code path; no fix is currently available for any of them. — Siemens PSIRT Advisory SSA-591731
- CISA republished the Siemens advisory as ICSA-26-295-14 on 2026-10-22, covering SIMATIC S7-1500 CPU variants, Drive Controller, ET 200SP Open Controller, S7-1500 Software Controller and S7-PLCSIM Advanced. — CISA ICS Advisory ICSA-26-295-14
- EPSS score is 0.00187 (8.3th percentile) as of 2026-10-28. — FIRST EPSS
