CVE-2026-63353 is a critical (CVSS 9.6) cross-site scripting flaw in the web server of several Siemens SIMATIC controllers: a crafted trace file can run attacker JavaScript in an authorized user's browser and carry out PLC operations with that user's permissions.
What Is It
The affected Siemens devices don't properly sanitize comment fields in imported trace files before showing them on the web server's Trace page. An attacker can build a trace file with malicious content in those comment fields. The attacker then has to talk an authorized user who holds the "Read diagnostics" function right into importing it.
Once the file is rendered, the attacker's JavaScript runs in the victim's browser session. It can then perform PLC operations through the web server, limited to whatever the user is authorized to do.
Why It Matters
NVD rates this flaw 9.6 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. That vector means:
- the attack works over the network,
- it is low complexity and needs no privileges,
- it needs one action from the user (importing the file),
- its impact reaches beyond the vulnerable component (changed scope),
- and it has high impact on confidentiality, integrity, and availability.
The danger is that the attacker acts through a trusted user's session. Through it, they can carry out PLC operations on industrial control equipment. On controllers that run physical processes, that combination deserves attention even though it needs social engineering.
Exploitation status: The supplied CISA KEV entry is empty, so CISA has not confirmed active exploitation. The NVD record is in "Received" status and was published on 2026-10-13.
What's Vulnerable
The Siemens advisory data in NVD lists these affected products, among others (the supplied list was cut off):
- SIMATIC Drive Controller CPU 1504D TF and CPU 1507D TF
- SIMATIC ET 200SP CPU 1510SP-1 PN, 1510SP F-1 PN, 1512SP-1 PN, 1512SP F-1 PN
- SIMATIC ET 200SP CPU 1514SP-2 PN, 1514SP F-2 PN, 1514SPT-2 PN, 1514SPT F-2 PN
- SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants): V2 CPUs on Windows OS, and V3 CPUs on Industrial OS and Windows OS
- SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs
- SIMATIC S7-1500 CPU 1511-1 PN
For every product in the supplied record, the affected range is "0 to *". The record gives no fixed version boundaries, so check exact versions in the vendor advisory.
Patch Status
The supplied NVD data has no fixed versions, and no KEV required action or due date applies. Siemens ProductCERT published advisory SSA-591731 for this issue. Check it for current fixes, workarounds, and the full list of affected products. Until a fix is confirmed, make sure users with the "Read diagnostics" right don't import trace files from untrusted sources, since exploitation depends on that import.