As reported by CISA in advisory ICSA-26-295-10, Siemens has disclosed two High-severity vulnerabilities in the .NET Client Library for SIMATIC S7 Webserver API — CVE-2026-85114 (CVSS 7.5) and CVE-2026-85115 — both carrying significant implications for operational technology environments where SIMATIC S7 PLCs are deployed.
Vulnerability Summary
| CVE | Severity | Type | Affected Versions | Fix Version |
|---|---|---|---|---|
| CVE-2026-85114 | High (7.5) | Path Traversal (CWE-22) | < V3.3.61 | V3.3.61+ |
| CVE-2026-85115 | High (7.5) | Sensitive Info Exposure | < V3.3.62 | V3.3.62+ |
Why This Matters Beyond the CVSS Score
On paper, a 7.5 High might seem routine. In an ICS context, however, these two flaws compound each other in ways that the individual scores don't capture. CVE-2026-85114 is a path traversal that allows an attacker who can manipulate ticket responses from a remote server to write arbitrary files — potentially overwriting existing application files if that feature is enabled. This is not just a data exfiltration concern; in a manufacturing or energy environment, overwriting configuration or application files on a system that interfaces with PLCs could result in process disruption, unsafe conditions, or integrity loss across the OT tier.
CVE-2026-85115 is arguably the more insidious of the pair. The library fails to redact PLC restore passwords from HTTP exception messages. That means any logging infrastructure, diagnostic dashboard, or SIEM ingestion pipeline that captures these errors will record plaintext restore credentials. An attacker with read access to logs — a common post-initialial-access lateral movement technique — gains everything needed to perform unauthorized operations on the PLC itself, potentially bypassing the protections the SIMATIC platform is trusted to enforce.
The combination is what concerns Shield53 most: file write capability plus credential leakage creates a realistic scenario where an attacker moves from client-side compromise to direct PLC manipulation without needing to exploit the PLC firmware itself.
Who Is Most Exposed
- Critical Manufacturing and Energy sectors running SIMATIC S7-1500 series PLCs with the .NET Client Library for management or HMI integration
- Environments where overwriting is enabled in the download configuration — this amplifies CVE-2026-85114 impact
- Organizations with centralized logging or monitoring that captures raw exception messages from the webserver API client — increasing the blast radius of CVE-2026-85115
- Any deployment using the client library version older than V3.3.62, since both vulnerabilities are present below that threshold
Shield53 Recommendations
Immediate Actions
Detection Considerations
Defenders should write detection rules for anomalous file write activity originating from the .NET Client Library process, and alert on any HTTP 4xx/5xx exception messages containing password-related substrings in centralized logging. If you're ingesting these logs into a SIEM, consider implementing a DLP-style filter for PLC restore credential patterns until all client library instances are confirmed patched.
No active exploitation has been reported at time of disclosure, but the window between advisory publication and threat actor weaponization in the ICS space has been steadily shrinking. Treat this as time-sensitive.
