Siemens Patches SIMATIC S7 Webserver API Vulnerabilities
The software update addresses two security flaws that could allow unauthorized file writes or data access.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Do you trust that current security updates are enough to keep your digital systems safe?
Siemens has released a security update for its .NET Client Library for SIMATIC S7 Webserver API to remediate two vulnerabilities that could allow unauthorized data access or arbitrary file writes. The company issued the patch for all software versions below 3.3.61 and 3.3.62.
Why it matters
Industrial control systems are frequent targets for cyberattacks, and vulnerabilities in APIs that interact with SIMATIC S7 devices can provide attackers with unauthorized access to sensitive operational data. Addressing these flaws is critical for maintaining the integrity of industrial environments using Siemens automation components.
The update mitigates security flaws tracked as CVE-2026-85114 and CVE-2026-85115, which affected software versions below 3.3.61 and 3.3.62. These vulnerabilities previously enabled attackers to bypass directory restrictions to write arbitrary files or exfiltrate sensitive data.
The players
Siemens
A Germany-based industrial manufacturing conglomerate that produces automation, electrification, and digitalization hardware and software.
CISA
The Cybersecurity and Infrastructure Security Agency is the U.S. federal authority responsible for assessing and mitigating threats to national infrastructure.
The details
The vulnerabilities exist within the .NET Client Library, a software interface that allows developers to programmatically interact with the SIMATIC S7 Webserver API. By exploiting these flaws, an attacker could achieve arbitrary file write capability, effectively allowing them to plant files outside the intended download directory, or access data not intended for external consumption. Siemens recommends that operators reinforce these software controls by implementing strict network segmentation and adhering to established industrial security guidelines.
Timeline
- 2026-10-13
Siemens issued the initial security advisory.
- 2026-10-22
CISA published the official advisory.
The Tech Race
This vulnerability remediation aligns with a broader effort to harden the security of industrial automation APIs against sophisticated network threats. It follows the pattern established by CISA's industrial security advisory framework, which provides standardized guidance for securing control systems.
Operators running versions of the .NET Client Library below 3.3.61 and 3.3.62 should update their software immediately to close these entry points. CISA advises that all control systems remain isolated behind firewalls and off public-facing networks to minimize exposure.
The takeaway
The security of industrial automation relies on constant patching of middleware like client libraries that serve as gateways to hardware. Security teams should monitor future Siemens bulletins for further patches and verify that all internet-connected industrial assets are properly air-gapped.
Further reading
For more on securing critical infrastructure, see our latest coverage in Cybersecurity.
More information
For detailed mitigation procedures, visit the Siemens industrial security operational guidelines.
Source note: This article includes information reported by Cisa.
Live Poll
Do you trust that current security updates are enough to keep your digital systems safe?
