# CVE-2026-63356: Siemens SIMATIC S7 PLC stored XSS in trace file import Source: https://junglewise.ai/threats/cve-2026-63356-affected-devices-do-not-properly-sanitize-calculated-signal-names Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-10-13. Updated: 2026-10-16 License: CC BY 4.0 with a link back CVE-2026-63356 · Severity: medium · CVSS 6.1 · Published 2026-10-13 Siemens SIMATIC S7 programmable logic controllers (PLCs) that manage industrial processes contain a cross-site scripting (XSS) vulnerability in their web-based diagnostics interface. An attacker can craft a malicious CSV trace file that, when imported by an authorized user, executes arbitrary JavaScript in the user's browser session, potentially allowing the attacker to manipulate PLC operations or steal sensitive configuration data. Technologies: [Siemens SIMATIC Drive Controller CPU 1504D TF](https://junglewise.ai/threats/technologies/simatic-drive-controller-cpu-1504d-tf), [Siemens SIMATIC Drive Controller CPU 1507D TF](https://junglewise.ai/threats/technologies/simatic-drive-controller-cpu-1507d-tf), [Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1510sp-f-1-pn), [Siemens SIMATIC ET 200SP CPU 1510SP-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1510sp-1-pn), [Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1512sp-f-1-pn), [Siemens SIMATIC ET 200SP CPU 1512SP-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1512sp-1-pn), [Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1514sp-f-2-pn), [Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC](https://junglewise.ai/threats/technologies/simatic-et-200sp-open-controller-cpu-1515sp-pc), [Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2](https://junglewise.ai/threats/technologies/simatic-et-200sp-open-controller-cpu-1515sp-pc2). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens). ## Quick answers **Is CVE-2026-63356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63356 being exploited in the wild. **How severe is CVE-2026-63356?** Medium severity, with a CVSS score of 6.1, published 13 October 2026. **Which products and versions are affected?** Siemens SIMATIC Drive Controller CPU 1504D TF All versions; Siemens SIMATIC Drive Controller CPU 1507D TF All versions; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN All versions; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN All versions; and 6 more. **Is there a fix for CVE-2026-63356?** No fixed version is recorded yet. Siemens reports that currently no fixes are available; administrators should restrict access to the diagnostics interface and monitor for suspicious trace file imports from untrusted sources. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-63356 attacked?** It is attacked over the network, in a network appliance. **Am I affected by CVE-2026-63356?** Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix Siemens reports that currently no fixes are available; administrators should restrict access to the diagnostics interface and monitor for suspicious trace file imports from untrusted sources. ## Technical details The vulnerability is a stored XSS flaw in the Trace page where calculated signal names from imported CSV trace files are not properly sanitized before being displayed in error messages. An attacker must social engineer an authorized user with the "Read diagnostics" function right to import a specially crafted CSV file. This requires user interaction but no additional authentication, and results in arbitrary JavaScript execution within the user's authenticated browser context. ## Affected products - Siemens SIMATIC Drive Controller CPU 1504D TF All versions - Siemens SIMATIC Drive Controller CPU 1507D TF All versions - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 All versions (V2 and V3 CPUs) - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 All versions (V4 CPUs) - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC All versions - Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN All versions - Siemens SIMATIC ET 200SP CPU 1510SP-1 PN All versions - Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN All versions - Siemens SIMATIC ET 200SP CPU 1512SP-1 PN All versions - Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN All versions ## Timeline - 2026-10-13: disclosed ## References - [https://cert-portal.siemens.com/productcert/html/ssa-591731.html](https://cert-portal.siemens.com/productcert/html/ssa-591731.html) ## Related threats - [Siemens SIMATIC S7 PLC web server cross-site scripting](https://junglewise.ai/threats/cve-2026-63357-affected-devices-do-not-properly-sanitize-calculated-signal-data) - [Siemens SIMATIC S7 PLCs stored XSS in trace file import](https://junglewise.ai/threats/cve-2026-63355-affected-devices-do-not-properly-sanitize-signal-names-contained) - [Siemens SIMATIC S7-1500 XSS in trace file import](https://junglewise.ai/threats/cve-2026-63354-affected-devices-do-not-properly-validate-and-sanitize-visual) - [Siemens SIMATIC S7 web server stored XSS in trace import](https://junglewise.ai/threats/cve-2026-63353-affected-devices-do-not-properly-sanitize-comment-fields) - [Siemens SIMATIC S7-1500 web server XSS via CSV trace import](https://junglewise.ai/threats/cve-2026-63352-affected-devices-do-not-properly-sanitize-calculated-signal-data)