CVE-2026-85114: S7 Webserver API Path Traversal (pending)

CVE-2026-85114 is a path-traversal vulnerability in Siemens' .NET Client Library for the SIMATIC S7 Webserver API: because the library does not validate filenames in remote-server ticket responses, an attacker who can manipulate that response can write arbitrary files outside the intended download directory and overwrite files the application can access; NVD has not, as of 2026-10-24, completed its own CVSS scoring.

CVE-2026-85114 (CWE-22, path traversal) affects the .NET Client Library for Siemens' SIMATIC S7 Webserver API, used by client applications that download diagnostic and configuration data from S7 controllers over the web server API. NVD's description, drawn from Siemens' own CVE record, states: "Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application" (NVD).

NVD tracks the CVE with status "Deferred" as of 2026-10-23: it records Siemens' own CVSS v3.1 submission of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, and a CVSS v4.0 score of 8.7, but has not published its own independent score or a CPE applicability statement, so this page does not show a headline severity score rather than presenting Siemens' figure as NVD-confirmed (NVD).

Siemens' Security Advisory SSA-390352, published 2026-10-13, bundles CVE-2026-85114 with a second, lower-severity issue, CVE-2026-85115 (CWE-209, generation of an error message containing sensitive information, CVSS v3.1 5.5): the library fails to redact PLC restore passwords from HTTP error-exception messages, potentially exposing them in plaintext. The path-traversal issue is fixed in library version V3.3.61; the password-exposure issue is fixed in V3.3.62 (Siemens Security Advisory SSA-390352).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-23, and FIRST scores the probability of exploitation at 0.00442 (37.424th percentile) (CISA KEV, FIRST EPSS).

NVD has marked this CVE "Deferred" rather than completing its own severity and applicability analysis. In the meantime, applications using the .NET Client Library for the SIMATIC S7 Webserver API should update to V3.3.62 or later, which fixes both disclosed issues.

• The library does not validate filenames from remote-server ticket responses, letting an attacker who can manipulate the response write arbitrary files outside the download directory and, with overwriting enabled, replace accessible files (CWE-22). — NVD
• NVD status is "Deferred" with Siemens-submitted CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, and CVSS v4.0 8.7; no NVD-published score or CPE configuration as of 2026-10-23. — NVD
• Bundled with CVE-2026-85115 (plaintext PLC restore passwords exposed in HTTP error messages, CVSS v3.1 5.5); path-traversal fixed in V3.3.61, password-exposure fixed in V3.3.62. — Siemens Security Advisory SSA-390352
• Not present in the CISA KEV catalog as of 2026-10-23. — CISA KEV
• EPSS score is 0.00442 (37.424th percentile) as of 2026-10-23. — FIRST EPSS