Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Industrial control advisorySeverity 7.5 high

Siemens SIMATIC S7 Webserver API

ICSA-26-295-10 · CISA · October 13, 2026

Summary

.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.

From CISA, quoted as published. Check the source before acting.

What to do

Update to V3.3.61 or later version Update to V3.3.62 or later version

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2026-851147.5 highNo0.3%Improper Limitation of a Pathname to a Restricted Directory (CWE-22)
CVE-2026-851155.5 mediumNo0.1%Generation of Error Message Containing Sensitive Information (CWE-209)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
Siemens.NET Client Library for SIMATIC S7 Webserver APIvers:intdot/<3.3.61, vers:intdot/<3.3.62—

Why it's on these mode pages

  • Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. October 13, 2026: Publication Date
  2. October 22, 2026: Initial CISA Republication of Siemens ProductCERT SSA-390352 advisory
  3. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com