Skip to contentSiemens Simatic S7-1500 Cpu vulnerabilities
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize calculated signal data contained in imported calculated...CVE-2026-633575.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize calculated signal names contained in imported CSV trace...CVE-2026-633565.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize signal names contained in imported CSV trace files...CVE-2026-633555.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly validate and sanitize visual marker data contained in imported...CVE-2026-633549.4 Critical
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize comment fields contained in imported trace files before...CVE-2026-633539.4 Critical
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly sanitize calculated signal data contained in imported CSV trace...CVE-2026-633525.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly validate and sanitize visual properties of calculated signals...CVE-2026-633515.3 Medium
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +100 more +102 moreAffected devices do not properly restrict executable content contained in imported trace files.
...CVE-2026-633509.4 Critical
- libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBufferCVE-2026-77214Fix available8.3 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreSSLContext.wrap_bio() missing validation of server_hostname parameterCVE-2026-19553Public exploitFix available7.6 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreUse-after-free of a server-side SSLContext when sni_callback switches contextsCVE-2026-19445Public exploitFix available9.2 Critical
- libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat 2.7.2 through 2.8.5 Integer Overflow in expat_reallocCVE-2026-102633Fix available8.2 High
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreTiming Side-Channel in SM2 Signature GenerationCVE-2026-77696Fix available3.7 Low
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreUnauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoSCVE-2026-75806Fix available5.3 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreNULL Pointer Dereference in CMP Client Revocation Response HandlingCVE-2026-75805Fix available5.3 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreTiming Side-Channel in Scalar Multiplication for Non-NIST EC CurvesCVE-2026-54872Fix available3.7 Low
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreExcessive Memory Allocation in Relative CRLDP ProcessingCVE-2026-35189Fix available5.3 Medium
- libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreExpat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked SurrogateCVE-2026-93990Fix available8.7 High
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreDTLS Retransmits Handshake Messages From a Stale Buffer OffsetCVE-2026-84782Fix available8.2 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morezipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitsCVE-2026-15310Fix available2.1 Low
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a...CVE-2026-76957Fix available4.9 Medium
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 more`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matchingCVE-2026-15806Fix available6.0 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreExpat Denial of Service via storeAtts() Quadratic ComplexityCVE-2026-66046Fix available8.7 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morestringprep.map_table_b2() deviates from RFC 3454 Table B.2CVE-2026-17084Fix available6.0 Medium
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0), simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0) +2 more +4 morePerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclassCVE-2026-19487Fix available5.3 Medium
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreSuper-linear CPU usage for unbounded input to csv.Sniffer.sniff()CVE-2026-18503Fix available2.4 Low
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low...CVE-2026-72522Fix available6.2 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreposix-cpu-timers: Prevent UAF caused by non-leader exec() raceCVE-2026-64560Public exploitFix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morevirtio-net: fix len check in receive_big()CVE-2026-64552Fix available8.4 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet, bpf: check master for NULL in xdp_master_redirect()CVE-2026-64545Fix available7.5 High
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreipv6: Fix null-ptr-deref in fib6_nh_mtu_change().CVE-2026-64538Fix available5.7 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreio_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work itemCVE-2026-64425Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreipv4: igmp: remove multicast group from hash table on device destructionCVE-2026-64423Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: ipv4: bound TCP reordering sysctl writes and MTU probe sizesCVE-2026-64422Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ebtables: zero chainstack arrayCVE-2026-64413Fix available7.0 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ebtables: module names must be null-terminatedCVE-2026-64412Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ebtables: terminate table name before find_table_lock()CVE-2026-64411Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreproc: protect ptrace_may_access() with exec_update_lock (FD links)CVE-2026-64375Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreproc: protect ptrace_may_access() with exec_update_lock (part 1)CVE-2026-64371Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreposix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error pathCVE-2026-64370Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreisofs: bound Rock Ridge symlink components to the SL recordCVE-2026-64317Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morei2c: core: fix adapter deregistration raceCVE-2026-64279Fix available7.8 High
- libssh2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibssh2 Heap Out-of-Bounds Read via publickey subsystemCVE-2026-66034Fix available7.7 High
- libssh2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibssh2 Double-Free Heap Corruption via sftp_open()CVE-2026-66032Fix available8.7 High
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreblock: Avoid mounting the bdev pseudo-filesystem in userspaceCVE-2026-63810Fix available6.8 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morei2c: core: fix adapter registration raceCVE-2026-53400Fix available7.8 High
- perl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morePerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string bra…CVE-2026-13221Fix available9.1 Critical
- perl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morePerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpackCVE-2026-57432Fix available8.4 High
- haarg storable, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreStorable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK recordCVE-2026-57433Fix available9.8 Critical
- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarationsCVE-2026-15308Fix available8.7 High
- Show moreLoading…