Siemens SIMATIC S7 PLCs Web Server
SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7 PLCs Web Server are affected: SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) vers:all/* (CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-6
Read at CISA Cybersecurity Advisories
- Vendor
- Siemens
- Product
- SIMATIC / RUGGEDCOM / SINEC / SCALANCE / WinCC / TIA Portal
- CVSS
- 3.1
- Fix
- not yet available
- Exposure class
- OT / ICS
Why it ranks 21 (Routine)
- Product class: OT / ICS
- Covered by 2 independent sources
- Government advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CISA Cybersecurity Advisories (cisa.gov)
- CVE-2026-63350 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-63351 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-63352 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-63353 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-63354 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.