Anyone using Siemens' .NET Client Library for the SIMATIC S7 Webserver API should move to version 3.3.62 or later. Versions below that carry two vulnerabilities, one rated high and one medium.
The more serious bug, CVE-2026-85114, scores 7.5 out of 10 (high). The library does not properly check filenames it receives from remote servers during ticket downloads. An attacker who can tamper with that server response could write files outside the intended download folder. Where overwriting is enabled, they could replace existing files the application can reach. This flaw is a classic path traversal, and it is fixed in 3.3.61.
The second, CVE-2026-85115, scores 5.5 (medium). When an HTTP request fails, the library puts the restore password for a PLC into the error message in plaintext. A PLC is the programmable logic controller that runs machinery on a factory floor or in a utility. Someone with access to logs or other diagnostic output could read that password and potentially perform unauthorized operations on the controller. The fix arrives in 3.3.62, so that version covers both bugs.
The scores deserve some reading. The 7.5 assumes a network attacker needing no privileges, but the attack still depends on controlling or intercepting the server's reply. The 5.5 is a local, low-privilege scenario that requires reaching the logs. Neither flaw looks like a remote takeover of a controller. Both are the kind of weakness that matters most when chained with a foothold already gained elsewhere.
This is a client library, so the patch sits with whoever builds tools on top of it, not in controller firmware. Siemens ProductCERT reported the flaws, and the advisory (SSA-390352) was first released on October 13, then republished on October 22. Siemens also repeated its standard advice to restrict network access to devices and follow its industrial security guidelines. The advisory lists sectors from manufacturing and energy to healthcare, which shows how widely this product family is deployed, though not how many installations use this particular library.