# Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP vulnerabilities

Source: https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 83 vulnerabilities in Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP: 0 in the last 7 days and 0 in the last 90 days, 5 of them critical and 1 exploited in the wild. The most recent, CVE-2026-43040, was published on 1 May 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 83 (5 critical, 1 exploited in the wild)

## About Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Siemens SIMATIC S7-1500 programmable logic controller with modular processor unit for industrial automation.

## Latest Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP vulnerabilities

- [CVE-2026-43040: Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg) (high, CVSS 7.1, published 1 May 2026)
- [CVE-2026-43035: Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node) (medium, CVSS 5.5, published 1 May 2026)
- [CVE-2026-43033: Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption) (high, CVSS 7.8, published 1 May 2026)
- [CVE-2026-43030: Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe) (high, CVSS 7.8, published 1 May 2026)
- [CVE-2026-43028: Linux Kernel Netfilter missing null-termination in x_tables](https://junglewise.ai/threats/cve-2026-43028-linux-kernel-netfilter-missing-null-termination-in-x-tables) (high, CVSS 7.1, published 1 May 2026)
- [CVE-2026-43027: Linux Kernel use-after-free in Netfilter nf_conntrack_helper](https://junglewise.ai/threats/cve-2026-43027-linux-kernel-use-after-free-in-netfilter-nf-conntrack-helper) (high, CVSS 7.8, published 1 May 2026)
- [CVE-2026-43026: Linux Kernel Netfilter uninitialized memory use in ctnetlink](https://junglewise.ai/threats/cve-2026-43026-linux-kernel-netfilter-uninitialized-memory-use-in-ctnetlink) (medium, CVSS 5.5, published 1 May 2026)
- [CVE-2026-43025: Linux Kernel Netfilter out-of-bounds read in ctnetlink](https://junglewise.ai/threats/cve-2026-43025-linux-kernel-netfilter-out-of-bounds-read-in-ctnetlink) (high, CVSS 7.3, published 1 May 2026)
- [CVE-2026-43011: Linux Kernel double free in net/x25 networking stack](https://junglewise.ai/threats/cve-2026-43011-linux-kernel-double-free-in-net-x25-networking-stack) (critical, CVSS 9.8, published 1 May 2026)
- [CVE-2026-31768: Linux Kernel ti-adc161s626 DMA-safe memory corruption](https://junglewise.ai/threats/cve-2026-31768-linux-kernel-ti-adc161s626-dma-safe-memory-corruption) (high, CVSS 7.8, published 1 May 2026)
- [CVE-2026-31752: Linux Kernel out-of-bounds read in bridge ND option parsing](https://junglewise.ai/threats/cve-2026-31752-linux-kernel-out-of-bounds-read-in-bridge-nd-option-parsing) (medium, CVSS 5.5, published 1 May 2026)
- [CVE-2026-31737: Linux Kernel ftgmac100 resource leak in ring allocation failure](https://junglewise.ai/threats/cve-2026-31737-linux-kernel-ftgmac100-resource-leak-in-ring-allocation-failure) (medium, CVSS 5.5, published 1 May 2026)
- [CVE-2026-5435: GNU glibc out-of-bounds write in ns_printrrf TSIG handling](https://junglewise.ai/threats/cve-2026-5435-gnu-glibc-out-of-bounds-write-in-ns-printrrf-tsig-handling) (high, CVSS 7.3, published 28 Apr 2026)
- [CVE-2026-31682: Linux Kernel out-of-bounds read in bridge br_nd_send](https://junglewise.ai/threats/cve-2026-31682-linux-kernel-out-of-bounds-read-in-bridge-br-nd-send) (critical, CVSS 9.1, published 25 Apr 2026)
- [CVE-2026-31680: Linux Kernel use-after-free in IPv6 flowlabel](https://junglewise.ai/threats/cve-2026-31680-linux-kernel-use-after-free-in-ipv6-flowlabel) (high, CVSS 7.8, published 25 Apr 2026)
- [CVE-2026-31674: Linux Kernel out-of-bounds access in netfilter ip6t_rt](https://junglewise.ai/threats/cve-2026-31674-linux-kernel-out-of-bounds-access-in-netfilter-ip6t-rt) (high, CVSS 7.1, published 25 Apr 2026)
- [CVE-2026-31671: Linux Kernel information leak in xfrm_user build_report](https://junglewise.ai/threats/cve-2026-31671-linux-kernel-information-leak-in-xfrm-user-build-report) (medium, CVSS 5.5, published 24 Apr 2026)
- [CVE-2026-31670: Linux Kernel memory exhaustion in rfkill subsystem](https://junglewise.ai/threats/cve-2026-31670-linux-kernel-memory-exhaustion-in-rfkill-subsystem) (medium, CVSS 5.5, published 24 Apr 2026)
- [CVE-2026-31628: Linux Kernel information disclosure in AMD Zen1 hardware divider](https://junglewise.ai/threats/cve-2026-31628-linux-kernel-information-disclosure-in-amd-zen1-hardware-divider) (medium, CVSS 5.5, published 24 Apr 2026)
- [CVE-2026-31563: Linux Kernel DoS in macb network driver via invalid IRQ context](https://junglewise.ai/threats/cve-2026-31563-linux-kernel-dos-in-macb-network-driver-via-invalid-irq-context) (high, CVSS 7.5, published 24 Apr 2026)
- [CVE-2026-31555: Linux Kernel stale pointer in futex_lock_pi retry path](https://junglewise.ai/threats/cve-2026-31555-linux-kernel-stale-pointer-in-futex-lock-pi-retry-path) (medium, CVSS 5.5, published 24 Apr 2026)
- [CVE-2026-31546: Linux Kernel NULL pointer dereference in bonding debugfs](https://junglewise.ai/threats/cve-2026-31546-linux-kernel-null-pointer-dereference-in-bonding-debugfs) (medium, CVSS 5.5, published 24 Apr 2026)
- [CVE-2026-31533: Linux Kernel use-after-free in net/tls encryption error path](https://junglewise.ai/threats/cve-2026-31533-linux-kernel-use-after-free-in-net-tls-encryption-error-path) (critical, CVSS 9.8, published 23 Apr 2026)
- [CVE-2026-41989: GnuPG Libgcrypt heap buffer overflow in ECDH decryption](https://junglewise.ai/threats/cve-2026-41989-gnupg-libgcrypt-heap-buffer-overflow-in-ecdh-decryption) (medium, CVSS 6.7, published 23 Apr 2026)
- [CVE-2026-31521: Linux Kernel out-of-bounds read in module loader simplify_symbols](https://junglewise.ai/threats/cve-2026-31521-linux-kernel-out-of-bounds-read-in-module-loader-simplify-symbols) (medium, CVSS 5.5, published 22 Apr 2026)

## Most severe Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP vulnerabilities

- [CVE-2025-39964: Linux Kernel race condition in af_alg_sendmsg](https://junglewise.ai/threats/cve-2025-39964-linux-kernel-race-condition-in-af-alg-sendmsg) (critical, exploited in the wild, CVSS 3.3, published 13 Oct 2025)
- [CVE-2026-43011: Linux Kernel double free in net/x25 networking stack](https://junglewise.ai/threats/cve-2026-43011-linux-kernel-double-free-in-net-x25-networking-stack) (critical, CVSS 9.8, published 1 May 2026)
- [CVE-2026-5450: GNU glibc heap buffer overflow in scanf %mc specifier](https://junglewise.ai/threats/cve-2026-5450-gnu-glibc-heap-buffer-overflow-in-scanf-mc-specifier) (critical, CVSS 9.8, published 20 Apr 2026)
- [CVE-2026-31533: Linux Kernel use-after-free in net/tls encryption error path](https://junglewise.ai/threats/cve-2026-31533-linux-kernel-use-after-free-in-net-tls-encryption-error-path) (critical, CVSS 9.8, published 23 Apr 2026)
- [CVE-2026-31682: Linux Kernel out-of-bounds read in bridge br_nd_send](https://junglewise.ai/threats/cve-2026-31682-linux-kernel-out-of-bounds-read-in-bridge-br-nd-send) (critical, CVSS 9.1, published 25 Apr 2026)
- [CVE-2025-71162: Linux Kernel Tegra ADMA use-after-free in audio termination](https://junglewise.ai/threats/cve-2025-71162-linux-kernel-tegra-adma-use-after-free-in-audio-termination) (high, CVSS 7.8, published 25 Jan 2026)
- [CVE-2025-39683: Linux Kernel slab-out-of-bounds read in ftrace tracing subsystem](https://junglewise.ai/threats/cve-2025-39683-linux-kernel-slab-out-of-bounds-read-in-ftrace-tracing-subsystem) (high, CVSS 7.8, published 5 Sep 2025)
- [CVE-2025-38704: Linux Kernel invalid pointer access in RCU NOCB offload](https://junglewise.ai/threats/cve-2025-38704-linux-kernel-invalid-pointer-access-in-rcu-nocb-offload) (high, CVSS 7.8, published 4 Sep 2025)
- [CVE-2025-39787: Linux Kernel Qualcomm MDT loader buffer over-read](https://junglewise.ai/threats/cve-2025-39787-linux-kernel-qualcomm-mdt-loader-buffer-over-read) (high, CVSS 7.8, published 11 Sep 2025)
- [CVE-2025-38499: Linux Kernel missing CAP_SYS_ADMIN check in clone_private_mnt](https://junglewise.ai/threats/cve-2025-38499-linux-kernel-missing-cap-sys-admin-check-in-clone-private-mnt) (high, CVSS 7.8, published 11 Aug 2025)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Siemens technologies

- [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp): 204 vulnerabilities
- [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100): 79 vulnerabilities
- [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp): 70 vulnerabilities
- [Siemens RUGGEDCOM APE1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808): 28 vulnerabilities
- [Siemens Ruggedcom Rox II](https://junglewise.ai/threats/technologies/ruggedcom-rox-ii): 16 vulnerabilities
- [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p): 16 vulnerabilities
- [Siemens ROX II](https://junglewise.ai/threats/technologies/rox-ii): 14 vulnerabilities
- [Siemens RUGGEDCOM CROSSBOW](https://junglewise.ai/threats/technologies/ruggedcom-crossbow): 13 vulnerabilities
- [Siemens SINEC OS](https://junglewise.ai/threats/technologies/sinec-os): 12 vulnerabilities
- [Siemens Solid Edge](https://junglewise.ai/threats/technologies/solid-edge): 12 vulnerabilities
- [Siemens SIMATIC Drive Controller CPU 1504D TF](https://junglewise.ai/threats/technologies/simatic-drive-controller-cpu-1504d-tf): 11 vulnerabilities
- [Siemens SIMATIC Drive Controller CPU 1507D TF](https://junglewise.ai/threats/technologies/simatic-drive-controller-cpu-1507d-tf): 11 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP vulnerabilities", https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp, 11 November 2026.