Siemens S7 PLC security now has a federal reading list of one. On 19 August 2026, the NSA, CISA, FBI, Department of Energy and EPA published joint advisory AA26-231A, warning of an active campaign against Internet-exposed Siemens S7 controllers at U.S. critical infrastructure sites. The actors find targets through Censys and ZoomEye, talk to them over S7comm on TCP port 102, and write their tools with AI help on top of the open source snap7 library. The table maps every S7 family the advisory names to what the controller can enforce and the first move to make on it.
| S7 family | Models named in AA26-231A | What the controller can enforce | First move |
|---|---|---|---|
| S7-200 | All | A program password, little else | Block port 102 at the perimeter and plan the replacement |
| S7-300 | CPU 314, 315, 317 | Password-based write and read/write protection | Block port 102, then set a protection level |
| S7-400 | All | Password-based write and read/write protection | Block port 102, then set a protection level |
| S7-1200 | 1211C, 1212C, 1214C, 1215C, 1217C | Access levels (full, read, HMI, no access), secure PG/PC and HMI communication | Firmware at V4.5.0 or later, then an access level below full |
| S7-1500 | All, including F-series safety CPUs | Access levels, know-how protection, secure PG/PC and HMI communication | Firmware at V2.9.2 or later, then an access level below full |
Potential Operational Impacts Named in AA26-231A
The joint advisory names the U.S. critical infrastructure sectors most targeted by this activity as Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. Siemens S7 PLCs also run in other sectors, including the Defense Industrial Base, and could be targeted there as well. According to AA26-231A, unauthorized access to these PLCs could result in:
- Disruption of critical industrial processes affecting production throughput, product quality, and public services
- Safety incidents affecting personnel through manipulation of safety interlocks, emergency shutdown systems, or process parameters
- Equipment damage and extended operational downtime from process upsets, improper sequencing, or forced equipment operation outside design parameters
- Compromise of sensitive operational data, including proprietary process recipes, control strategies, and facility configurations
- Cascading impacts across interconnected systems affecting supply chains, dependent facilities, and integrated business operations
- Regulatory compliance violations and potential liability from process safety management failures
What AA26-231A Says About Siemens S7 PLCs
The advisory describes reconnaissance and capability development, not a confirmed outage. In CISA's words, the actors are "conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools." The agencies name the product line and the method, and they decline to name the actor, which leaves defenders with a clear target list and nobody to blame in the incident report.
No new vulnerability sits at the center of it. A Siemens spokesperson told Cybersecurity Dive the company had "not identified increased attack levels or unknown vulnerabilities in Siemens ICS products." The campaign works with features the controllers already have and settings their owners never changed. Our AA26-231A briefing deck walks the same ground as a hot-seat scenario for OT assessment teams.
AA26-231A Techniques: MITRE ATT&CK Mapping
The advisory maps the activity to the MITRE ATT&CK Matrix for ICS and the Matrix for Enterprise, both version 19.
| Technique ID | Name | What it looks like against an S7 |
|---|---|---|
| T1596.005 | Search Open Technical Databases: Scan Databases | Censys and ZoomEye queries for hosts answering on port 102 |
| T1588.007 | Obtain Capabilities: Artificial Intelligence | AI-assisted scripting to build S7 tooling without ICS experience |
| T1587.004 | Develop Capabilities: Exploits | Custom scripts built on snap7 or python-snap7 |
| T0849 | Masquerading | Tools named and shaped like legitimate OT monitoring software |
| T1694 | Insecure Credentials | Logging in to controllers left on default or minimal authentication |
| T0834 | Native API | Plain S7comm read and write calls, no exploit code required |
| T0821 | Modify Controller Tasking | Changing what the CPU runs and when |
| T0893 | Data from Local System | Pulling data blocks and configuration off the controller |
Why Port 102 Is the Front Door
S7comm is Siemens' proprietary protocol for its PLCs, carried over ISO-on-TCP (TPKT and COTP) on TCP port 102. Anything that can reach that port can ask the CPU for its module number, firmware version and system name, which is how a scan turns an IP address into a shopping list with the model number already filled in.
The advisory does not ask anyone to watch port 102 more carefully. It says to "Block TCP port 102 at perimeter firewalls entirely" and to keep PLCs off the Internet, with a DMZ between IT and OT. Treat raw scan totals with care, though, because other ISO-TSAP services answer on 102 too, so an open-port count overstates the number of controllers. For links that only need to carry data out of the plant, a data diode in place of the firewall removes the inbound path in hardware.
How AI-Assisted Tooling Changes the S7 Threat
Snap7 is an open source, multi-platform library for talking to S7 PLCs, and plant engineers use it for legitimate data collection every day. AA26-231A says the actors pair it with AI-assisted scripting "to create custom tools that mimic legitimate OT monitoring solutions," so the traffic looks like the dashboard someone in engineering wrote last spring.
What changed is the skill floor. Stuxnet was written specifically for S7-315 CPUs by a team with deep knowledge of the process it sabotaged. Reading and writing data blocks over S7comm needs far less, and a language model will draft the script, explain the protocol and suggest a plausible tool name in the same session.
Which Sectors AA26-231A Puts in Range
The advisory names Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities as the most targeted sectors, and flags the Defense Industrial Base as a possible target. The common thread is the hardware, since S7 CPUs run for decades between replacements and many were commissioned when port 102 on a public address raised no eyebrows at the design review. Sector context lives in our guides to energy and utilities and manufacturing threats.
"Many of these reported attacks appear to be the result of weak security processes and difficult-to-maintain hardware."
Jon Braley Director of Threat Intelligence, IT-ISAC and Food and Agriculture-ISAC, as quoted in Cybersecurity Dive
That diagnosis points the work at process first. A controller that cannot be patched this year can still be taken off the Internet this week, given a protection level this month, and watched by a sensor that knows what normal S7comm traffic looks like on that line.
Hardening a Siemens S7 Deployment
AA26-231A lists 21 mitigations. They fall into five groups, and the order matters: exposure first, then the controller, then the engineering path, then detection. On S7-1200 and S7-1500, firmware also closes CVE-2022-38465, a CVSS 9.3 flaw in how the CPUs protected a built-in global private key, fixed in S7-1200 V4.5.0 and S7-1500 V2.9.2.
Detection is where the masquerade gets caught. The advisory's indicators are specific enough to turn into alert rules on an ICS-aware sensor this week.
| Indicator from AA26-231A | Where to look |
|---|---|
| S7comm traffic on TCP 102 from unexpected sources | Perimeter and OT network flow logs |
| Python processes loading snap7.dll | Engineering workstations and jump hosts |
| Sequential IP scanning across controller subnets | ICS-aware intrusion detection |
| Unauthorized PUT/GET requests on data blocks | S7comm protocol monitoring and PLC diagnostics |
All 21 AA26-231A Mitigations, Grouped by Job
Each job carries the MITRE D3FEND countermeasures the advisory maps to it.
| Job | Mitigations from the advisory |
|---|---|
| Remove exposure (D3-NI) | Keep PLCs off the Internet; block TCP port 102 at perimeter firewalls entirely; place a DMZ between IT and OT |
| Know what you run (D3-HCI, D3-SU) | Inventory every S7 PLC; update firmware to versions that address known vulnerabilities, checked against Siemens ProductCERT advisories; contact Siemens for model-specific guidance |
| Lock the controller (D3-CH, D3-ACH) | Enable PLC password protection; configure protection levels (write, read/write); enable complete restart protection and know-how protection; disable S7 web servers not in use; disable unused protocols such as Modbus TCP and PROFINET; set connection resource limits; change or remove default SNMP community strings |
| Lock the engineering path (D3-NAM, D3-CH) | Restrict TIA Portal and STEP 7 access with MAC/IP allowlisting; application allowlisting on engineering workstations; MFA for remote OT access; log TIA Portal and STEP 7 connections |
| Watch the wire (D3-PM, D3-NTA) | Deploy ICS-aware intrusion detection; monitor S7comm traffic; alert on unauthorized PUT/GET; monitor for Python processes loading snap7.dll |
For the wider program these steps plug into, CISA's five primary mitigations for OT make a sound backbone, and our industrial engineering and cyber resilience guide shows how FMEA and control charts adapt once an adversary is on the failure list.
Frequently Asked Questions
- Does AA26-231A disclose a new Siemens S7 vulnerability?
- No. The campaign uses existing S7comm functions and weak configurations, and Siemens told Cybersecurity Dive it had not identified unknown vulnerabilities in its ICS products. Keeping firmware current still matters, because older CPUs carry known flaws such as CVE-2022-38465.
- What port does a Siemens S7 PLC use?
- TCP port 102. S7comm runs over ISO-on-TCP on that port, and AA26-231A tells operators to block it at perimeter firewalls entirely.
- Which Siemens S7 models does the advisory name?
- All S7-200, S7-400 and S7-1500 CPUs (including F-series safety CPUs), the S7-300 CPU 314, 315 and 317, and the S7-1200 1211C, 1212C, 1214C, 1215C and 1217C.
- Will blocking port 102 break TIA Portal access?
- Not from inside the OT network. Remote engineering should reach the controllers through a DMZ jump host with MFA and MAC/IP allowlisting, which the advisory lists among its mitigations.
- Where do I report suspicious activity on a Siemens S7 PLC?
- AA26-231A asks U.S. organizations to contact CISA's 24/7 Operations Center at [email protected] or 1-844-Say-CISA (1-844-729-2472), and the FBI through the Internet Crime Complaint Center or a local FBI field office. Energy sector entities follow their DOE reporting requirements, and Siemens ProductCERT takes reports about the controllers themselves.
About Siemens S7 PLC Security
- CISA AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs
- Siemens ProductCERT SSA-568427: weak key protection in S7-1200 and S7-1500
- Siemens ProductCERT and Siemens CERT
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- Secure connectivity principles for Operational Technology (OT)
- NSA and CISA: Control System Defense: Know the Opponent
- Wireshark Wiki: S7comm protocol reference
- MITRE ATT&CK Matrix for ICS, version 19
- MITRE ATT&CK Matrix for Enterprise, version 19
- MITRE ATT&CK for ICS: Modify Controller Tasking
- MITRE D3FEND
AA26-231A is a joint product of the NSA, CISA, FBI, DOE and EPA; Siemens ProductCERT publishes security advisories and firmware fixes for the SIMATIC S7 line.
Sources: CISA AA26-231A, Cybersecurity Dive, Siemens SSA-568427, Wireshark Wiki: S7comm, Snap7, MITRE ATT&CK: Stuxnet, MITRE ATT&CK: T0821, CISA Primary Mitigations for OT
