CVE-2026-63350

Scripting Execution in Imported Trace Files Enables PLC Operations

Published Oct 13, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
Affected devices do not properly restrict executable content contained in imported trace files.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Title Scripting Execution in Imported Trace Files Enables PLC Operations
Type Values Removed Values Added
Description Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Weaknesses CWE-95
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
siemens
Published
Updated
Oct 13, 2026, 12:56 PM
Reserved
Jul 16, 2026, 2:30 PM
Status
Awaiting Analysis
Published
Oct 13, 2026, 10:17 AM
Modified
Oct 15, 2026, 8:38 PM