Siemens is preparing fixes for eight vulnerabilities in the built-in web server of its SIMATIC S7-1500 programmable logic controllers (PLCs), the industrial computers that run factory equipment. Every version of the listed products is affected.
CISA, the US cybersecurity agency, published the advisory. The flaws are tracked as CVE-2026-63350 through CVE-2026-63357. According to the advisory, they could let an attacker run malicious code in an authorized user's browser session and perform PLC operations within the scope of that user's permissions. Siemens recommends specific mitigations for products where fixes are not or not yet available, though the advisory summary does not spell them out.
The product list is long. It covers the Drive Controller CPU 1504D TF and 1507D TF, a run of ET 200SP CPUs (1510SP, 1512SP, 1514SP and 1514SPT variants), and the ET 200SP Open Controller 1515SP PC family, including SIPLUS variants on Windows or Industrial OS. It also takes in S7-1500 CPUs from the 1511, 1511C, 1511F, 1511T and 1511TF lines, plus more 1512C and 1513 variants. All are listed as "all versions", which means no patched release exists yet for any of them.
The attack route sets a ceiling on the damage. Code running in an authorized user's browser is not the same as breaking into a controller from scratch. The attacker needs someone with access to the device, and what they can do is capped by that person's rights. That is a real limit, but an engineer with broad permissions is exactly the account an attacker would want to borrow.
Siemens controllers also carry history. Stuxnet, the worm discovered in 2010, sabotaged industrial processes by manipulating Siemens PLCs, and the category has drawn attention ever since. The open question here is how long the gap between this advisory and the patches lasts, and how many of these controllers sit where an ordinary office browser can reach them.