CISA republished two Siemens advisories on 22 October. The first covers eight flaws in the web server of SIMATIC S7-1500, ET 200SP and related controllers, scored up to CVSS 9.6. An attacker would need a user with the "Read diagnostics" right to import a crafted trace file. Their browser would then run the attacker's script, which could carry out PLC operations within that user's permissions. The second covers WinCC, where an authenticated user with database access could gain higher privileges and run commands on the host. Affected products and IDs ICSA-26-295-14 (S7 web server), CVE-2026-63350 to CVE-2026-63357. All versions are affected, covering S7-1500 CPUs (including F, T, TF, MFP and ODK variants), ET 200SP CPUs and Open Controllers, ET 200pro CPUs, S7-1500 Software Controllers, Drive Controllers 1504D/1507D TF, S7-PLCSIM Advanced and SIPLUS variants. There is no fix yet; Siemens is preparing fixes. ICSA-26-295-13 (Siemens SSA-550198), CVE-2026-59241, CVSS 8.8: WinCC V7.5, all versions, no fix; WinCC V8.0 before Update 11 is fixed in V8.0 Update 11; WinCC V8.1 before Update 7 is fixed in V8.1 Update 7. Exploitation status None known, according to the advisories. Why it matters to OT operators These controllers and WinCC are widely used in energy and process plants, and much of the PLC range has no patch yet. Until fixes arrive, Siemens advises turning off the PLC web server where it isn't needed, limiting ports 80/tcp and 443/tcp to trusted IP addresses, letting only qualified staff use the web server, and importing trace files only from trusted sources. WinCC V8.0 and V8.1 users should apply the listed updates. Sources CISA ICSA-26-295-14, Siemens SIMATIC S7 PLCs Web Server, 22 Oct 2026 CISA ICSA-26-295-13, Siemens WinCC, 22 Oct 2026 Source dates: 22 Oct 2026; 22 Oct 2026.
CISA republished two Siemens advisories on 22 October. The first covers eight flaws in the web server of SIMATIC S7-1500, ET 200SP and related controllers, scored up to CVSS 9.6. An attacker would need a user with the "Read diagnostics" right to import a crafted trace file. Their browser would then run the attacker's script, which could carry out PLC operations within that user's permissions. The second covers WinCC, where an authenticated user with database access could gain higher privileges and run commands on the host. Affected products and IDs ICSA-26-295-14 (S7 web server), CVE-2026-63350 to CVE-2026-63357. All versions are affected, covering S7-1500 CPUs (including F, T, TF, MFP and ODK variants), ET 200SP CPUs and Open Controllers, ET 200pro CPUs, S7-1500 Software Controllers, Drive Controllers 1504D/1507D TF, S7-PLCSIM Advanced and SIPLUS variants. There is no fix yet; Siemens is preparing fixes. ICSA-26-295-13 (Siemens SSA-550198), CVE-2026-59241, CVSS 8.8: WinCC V7.5, all versions, no fix; WinCC V8.0 before Update 11 is fixed in V8.0 Update 11; WinCC V8.1 before Update 7 is fixed in V8.1 Update 7. Exploitation status None known, according to the advisories. Why it matters to OT operators These controllers and WinCC are widely used in energy and process plants, and much of the PLC range has no patch yet. Until fixes arrive, Siemens advises turning off the PLC web server where it isn't needed, limiting ports 80/tcp and 443/tcp to trusted IP addresses, letting only qualified staff use the web server, and importing trace files only from trusted sources. WinCC V8.0 and V8.1 users should apply the listed updates. Sources CISA ICSA-26-295-14, Siemens SIMATIC S7 PLCs Web Server, 22 Oct 2026 CISA ICSA-26-295-13, Siemens WinCC, 22 Oct 2026 Source dates: 22 Oct 2026; 22 Oct 2026.