Defending Against an Active Threat to Siemens S7 Series PLCs

On August 14, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published a cybersecurity advisory warning of an active threat targeting Siemens S7 Series programmable logic controllers (PLCs). The advisory stresses that the activity is not limited to Siemens devices and urges all PLC owners and operators to implement protective measures.

Active targeting of Siemens S7 PLCs

The advisory describes ongoing malicious activity that specifically targets Siemens S7 Series PLCs. It notes that this represents only one part of a broader campaign against programmable logic controllers in general. The document does not state whether the threat has been exploited in the wild beyond the active targeting already observed, nor does it provide technical details of the specific intrusion methods used.

Who or what is affected

The advisory names Siemens S7 Series PLCs as the specific devices under active threat. However, it explicitly states that the risk extends to all programmable logic controllers. No specific firmware versions, exact models, or vulnerable software releases are listed. No victim organisations are named.

What to do

• Inventory all Siemens S7 Series PLCs present in your environment
• Ensure no Siemens S7 Series PLCs are directly accessible from the Internet
• Apply the same network segmentation and access-control principles to all other PLCs and operational technology systems
• Follow any additional mitigations published in the advisory for reducing exposure of industrial control systems
• Monitor CISA and Siemens channels for updated guidance on this campaign

Organisations operating industrial control systems should treat this advisory as part of a wider pattern of PLC targeting rather than an isolated Siemens issue.