NSA, CISA, the FBI, the Department of Energy, and the Environmental Protection Agency jointly released cybersecurity advisory AA26-231A on 19 August 2026, warning owners and operators of industrial control systems about an active — not theoretical — threat to Siemens S7 series programmable logic controllers. The advisory describes threat actors conducting reconnaissance and exploit-capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The agencies note that this pattern of targeting extends beyond Siemens equipment, and that all PLC owners should treat the mitigations as broadly applicable.
What the agencies found
Threat actors are using internet scanning services such as Censys and ZoomEye to locate S7 controllers reachable from the public internet, prioritizing devices running outdated firmware or lacking basic network protections. Once a candidate device is identified, the actors generate Python-based interaction scripts — built with AI coding assistance and leaning on open-source S7 libraries such as snap7.dll/python-snap7 — to perform read and write operations against PLC data blocks over the S7comm protocol, which runs on TCP port 102.
The advisory’s headline concern is not a new memory-corruption vulnerability but a shift in tradecraft: AI-assisted code generation is lowering the technical bar for building working ICS interaction tooling. Scripts are reportedly masquerading as monitoring or diagnostic utilities, which complicates identification by defenders who may see legitimate-looking S7comm traffic from an unfamiliar source.
Affected product lines named in the advisory span the full current and legacy S7 family: S7-200, S7-300 (including 314/315/317 CPU variants), S7-400, S7-1200 (1211C–1217C), and S7-1500, including F-series safety controllers. Sectors flagged as targeted include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, Commercial Facilities, and the Defense Industrial Base — effectively the standard cross-section of U.S. critical infrastructure that runs Siemens automation equipment.
Why S7comm exposure matters
S7comm is Siemens’ proprietary application-layer protocol for engineering and HMI communication with S7 controllers. It provides read/write access to memory areas, data blocks, and — depending on the controller’s protection level — the ability to upload or download control logic. The protocol predates modern authentication expectations: on many deployed S7-300/400 units, and on S7-1200/1500 units where password protection and access-level enforcement have not been explicitly configured, S7comm sessions require no credential at all. An actor who can reach TCP/102 can enumerate CPU state, read data blocks, and on unprotected devices, write to them — all without exploiting a traditional software vulnerability.
This is consistent with the pattern CISA has been documenting through 2026 in related advisories on internet-exposed PLCs (including the Iranian IRGC-affiliated CyberAv3ngers campaign detailed in AA26-097A): the barrier to disruptive OT access is frequently not a zero-day, it’s a controller with no network isolation and default configuration reachable from Shodan/Censys results.
Mitigations
The joint advisory’s priority actions are direct and should be treated as immediate work items rather than long-term roadmap items:
- Inventory every S7 series PLC in the environment and verify current firmware against a known-good backup (“gold copy”).
- Identify internet exposure. Confirm no S7 controller is directly or indirectly reachable from the public internet; block TCP/102 at the IT/OT perimeter and any cloud or remote-access gateway.
- Apply current Siemens firmware and test updates in a non-production environment before deployment, given the safety implications of controller firmware changes.
- Enable access protection — password protection, defined protection levels, and where supported, certificate-based access — rather than relying on network obscurity alone.
- Restrict engineering access via MAC/IP allowlisting and multi-factor authentication for any remote engineering workstation access to the OT network.
- Deploy ICS-aware monitoring capable of flagging anomalous S7comm sessions: unexpected source IPs initiating PUT/GET-style data block operations, sequential scanning across port 102 on an OT subnet, or snap7-library signatures originating from hosts other than known engineering workstations.
- Engage Siemens Technical Support for model-specific hardening guidance, particularly for legacy S7-300/400 CPUs that predate current protection-level features.
Practitioner takeaway
The advisory is notable less for the specific vendor named than for what it signals about the trajectory of ICS threat activity: AI-assisted tooling is compressing the time between “actor identifies an exposed asset” and “actor has working read/write access to that asset’s control logic.” For defenders, the response is unglamorous but unchanged — asset inventory, perimeter segmentation, and eliminating default S7comm exposure remain the highest-leverage controls, regardless of how the reconnaissance or scripting was produced on the attacker’s side. Organizations running S7-300 or S7-400 CPUs without configured protection levels should treat this advisory as a prompt to complete that hardening now rather than during incident response.
Report suspected activity matching these indicators to CISA (1-844-729-2472) or the FBI’s Internet Crime Complaint Center at ic3.gov, including timestamps, source addresses, and affected equipment models.