Vulnerabilities

Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.

Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Oracle

Product

java

CVSS

6.1

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-63357 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 21
   CISA advisory CISA 9d ago

   Siemens SIMATIC S7 PLCs Web Server

   CVSS 3.1 No fix yet CVE-2026-63350CVE-2026-63351CVE-2026-63352+5 more Siemens
2. 3
   CVE NVD 19d ago

   Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on…

   CVSS 6.1 CVE-2026-63356 Oracle
3. 3
   CVE NVD 19d ago

   Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace…

   CVSS 6.1 CVE-2026-63355 Oracle
4. 3
   CVE NVD 19d ago

   Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.

   CVSS 6.1 CVE-2026-63352 Oracle