Five US Agencies Warn of an Active Threat to Siemens S7 PLCs
Joint advisory AA26-231A describes exploitation scripts disguised as OT monitoring tools, riding the S7comm protocol on TCP port 102 to reach memory, configuration and ladder logic.
CISA published joint advisory AA26-231A, "Defending Against an Active Threat to Siemens S7 Series PLCs," on 19 August 2026, co-authored with the NSA, the FBI, the Department of Energy and the EPA. Five agencies signing one advisory is itself a signal about how the activity is being read.
The affected range is wide: S7-200, S7-300 including the 314, 315 and 317 CPUs, S7-400, the S7-1200 family covering the 1211C, 1212C, 1214C, 1215C and 1217C, and the S7-1500 family, F-series safety controllers included. The activity rides the S7comm protocol over TCP port 102 and uses the snap7 library and its Python binding. The advisory describes exploitation scripts, generated with AI assistance, disguised as legitimate OT monitoring tools, and giving read and write access to PLC memory, configuration and ladder logic.
No specific CVE identifiers are named. The advisory points instead at previously known critical and high severity flaws, which is worth reading carefully: the exposure being described is not a new vulnerability so much as the combination of well-documented weaknesses with controllers that are reachable and tooling that is now easy to produce.
Sectors named at risk are critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with potential exposure in the defense industrial base.
The listed mitigations are unglamorous and effective. Remove PLCs from internet exposure. Block TCP port 102 at the perimeter. Segment IT from OT. Enable PLC password protection. Require multi-factor authentication for remote access. Monitor with ICS-aware tooling.
For anyone who has commissioned S7 machines or skids, the practical task this week is an inventory: which S7 controllers you have put into service, which of them can be reached from outside the plant network, and whether port 102 is open at any perimeter you are responsible for. Engineering access left open on a flat network is the normal case rather than the exception, and it is precisely what this advisory describes being used.
Source: Tenable