Siemens has disclosed three critical flaws, CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354, in how dozens of SIMATIC controllers, including the S7-1500 family, handle imported trace files. Siemens rates each 9.6 (CVSS 3.1). An attacker must trick a user into importing a malicious trace file.
Correction (Oct 13): An earlier version said the flaws affect the SIMATIC Drive Controller CPU 1504D TF, that the CNA scored them 9.4 separately from Siemens, and that NVD rated them critical. The CVE records list dozens of SIMATIC products, including the S7-1500 CPU family. Siemens, which filed the records as the CVE numbering authority, rates each 9.6 under CVSS 3.1 and 9.4 under CVSS 4.0, and NVD has not published its own scores.
Correction (Oct 13): An earlier version said the flaws affect the SIMATIC Drive Controller CPU 1504D TF, that the CNA scored them 9.4 separately from Siemens, and that NVD rated them critical. The CVE records list dozens of SIMATIC products, including the S7-1500 CPU family. Siemens, which filed the records as the CVE numbering authority, rates each 9.6 under CVSS 3.1 and 9.4 under CVSS 4.0, and NVD has not published its own scores.
An attacker needs to deceive a user with the “Read diagnostics” right into loading a malicious trace file.
Once successful, the attacker can run JavaScript they control inside the browser and carry out PLC actions via the web server, limited to the user's permissions.
Correction (Oct 13): An earlier version said the flaws affect the SIMATIC Drive Controller CPU 1504D TF, that the CNA scored them 9.4 separately from Siemens, and that NVD rated them critical. The CVE records list dozens of SIMATIC products, including the S7-1500 CPU family. Siemens, which filed the records as the CVE numbering authority, rates each 9.6 under CVSS 3.1 and 9.4 under CVSS 4.0, and NVD has not published its own scores.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
The Analytics Insights – Google Analytics Dashboard for WordPress plugin is vulnerable to stored cross-site scripting tracked as CVE-2026-111820 in versions through 6.3.12. Unauthenticated attackers can inject scripts that execute for any visitor to an affected page.
A newly published CVE (CVE-2026-116199, assigned by VulnCheck on Oct 25) covers a flaw in Snipe-IT's Google SSO login. Versions before 8.6.3 didn't check whether an account was deactivated, so a former user whose Google account was still active could sign back in with their old permissions, including admin. It only applies when Google SSO is on and usernames are email addresses, and Snipe-IT says default installs aren't affected. The fix shipped in v8.6.3 on June 15, and the latest release is v8.8.3. VulnCheck scores it 9.2 Critical (CVSS 4.0) and 8.1 High (CVSS 3.1), while Snipe-IT's advisory rates it Moderate. It isn't in CISA's KEV catalog, and no public exploit or attacks have been reported.
ADT and Thrive Holdings announced an all-cash deal that values ADT at about $7.6 billion in equity value and $15.3 billion in enterprise value, according to the companies. ADT stockholders would get $10.00 per share, and the companies expect the deal to close in the first quarter of 2027, pending stockholder and US antitrust approval.
CISA says it added Linux kernel flaw CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on Oct. 28, with a federal deadline of Oct. 31 and forensic triage required. CISA says it can be chained with two PHP flaws to implant webshells and run commands as root.
CISA says it added CVE-2026-41709, an insufficient logging flaw in Broadcom's VMware ESX, to its Known Exploited Vulnerabilities catalog on Oct. 28. The flaw requires admin access, and CISA lists a Nov. 11 federal deadline; it has not said who is exploiting it.
