CVE-2026-63352: Siemens SIMATIC S7 PLC web server arbitrary code execution via malicious trace files

CVE-2026-63352 · Severity: critical · CVSS 9.6 · Published 2026-10-13

Siemens SIMATIC S7 programmable logic controllers (PLCs) are industrial automation devices that control manufacturing and infrastructure systems. An attacker can trick an authorized user into importing a specially crafted diagnostic trace file that contains malicious JavaScript code, which then executes in the user's browser session and allows the attacker to perform PLC operations with the user's privileges, potentially disrupting critical industrial processes.

Technologies: Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1510SP-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP-1 PN, Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4, Siemens SIMATIC S7-1500 CPU family. Vendors: Siemens.

Quick answers

Is CVE-2026-63352 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63352 being exploited in the wild.
How severe is CVE-2026-63352?
Critical severity, with a CVSS score of 9.6, published 13 October 2026.
Which products and versions are affected?
Siemens SIMATIC Drive Controller CPU 1504D TF all versions; Siemens SIMATIC Drive Controller CPU 1507D TF all versions; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions; and 6 more.
Is there a fix for CVE-2026-63352?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63352 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63352?
Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The web server in affected SIMATIC S7 PLCs fails to properly sanitize or restrict executable content in imported trace files, allowing arbitrary JavaScript execution within the authenticated user's browser context. Attack requires social engineering of a user holding the "Read diagnostics" function right to import a malicious trace file. Successful exploitation grants the attacker the ability to execute PLC operations within the scope of the victim's authorization; currently no fixes are available per the advisory.

Affected products

  • Siemens SIMATIC Drive Controller CPU 1504D TF all versions
  • Siemens SIMATIC Drive Controller CPU 1507D TF all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 all versions
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1512SP-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN all versions
  • Siemens SIMATIC S7-1500 CPU family all versions

Identifiers

  • CVE-2026-63352
  • CVE-2026-63354
  • CVE-2026-63355
  • CVE-2026-63356
  • CVE-2026-63357
  • CVE-2026-63350
  • CVE-2026-63353
  • CVE-2026-63351

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.