CISA Warns of Active Targeting on Siemens S7 PLCs: What Operators Should Check Now
On August 19, 2026, CISA, the NSA, FBI, DOE, and EPA published a warning of active reconnaissance and exploitation attempts against Internet-exposed or insufficiently segmented Siemens S7 Series PLCs. The activities documented in the advisory concern U.S. facilities, particularly in the sectors critical manufacturing, energy, water, chemical, and food. They do not provide evidence of a targeted campaign against European facilities or an incident in Germany. Nevertheless, it is worth considering this scenario and assessing possible precautionary measures.
Key Takeaways
- CISA AA26-231A confirms active, AI-assisted reconnaissance and exploitation activity against Internet-exposed or insufficiently segmented Siemens S7-200 through S7-1500 controllers.
- Threat actors use the open-source library Snap7 (snap7.dll / python-snap7) to read and write S7comm data while disguising their tools as legitimate OT monitoring software.
- The key risk mitigation measures mentioned in the recommendation are inventory management, patching, network segmentation, access control, and monitoring.
- Reducing the number of systems with direct PLC access lowers the risk and supports several of these protective measures at the same time.
- Middleware such as Softing SDEX Suite or dataFEED OPC Suite can centralize PLC connectivity behind standard, secured interfaces, but does not replace segmentation, patching, or traffic monitoring.
What the Advisory Describes
According to CISA, threat actors use Internet scanning services such as Censys and ZoomEye to locate S7 controllers that are reachable from the Internet via TCP port 102 or are insufficiently segmented. They then use publicly available device information and AI-assisted scripts to generate suitable exploitation code.
The tools described in the security advisory are based on the Snap7 library, which provides straightforward read and write access to S7comm data, CPU information, and data blocks. Since these tools may resemble legitimate development or monitoring traffic, detection depends on context and not solely on protocol signatures. Context includes, for example, which host initiated the connection, whether a write operation is taking place within an approved change window, and whether the source is an authorized development workstation.
CISA classify this as an active threat, since the potential consequences can be disruption of industrial processes, safety-relevant impacts, downtime, and compromise of process data.
Key Risk Factors and Mitigation Measures
Two important risk factors are whether the controller is reachable from an untrusted network and whether unnecessary read or write mechanisms, such as PUT/GET, are enabled. On S7-1200 and S7-1500 controllers, Snap7-style write access depends on PUT/GET being enabled. Legacy S7-300 and S7-400 controllers offer fewer built-in protections and typically require compensating controls at the network level instead.
CISA's mitigation list covers asset inventory, firmware patching, network segmentation, access control, logging and monitoring, and S7-specific hardening such as disabling unused protocols and limiting simultaneous connections. How these measures are combined depends on the installed systems and network architecture, but none of these areas should be assessed in isolation. A common goal should be that fewer systems have unmediated access to the PLC network, and every connection is traceable to an approved source and purpose.
Reducing Direct PLC Access Through Middleware
One recurring pattern behind PLC exposure is architectural: applications such as MES, historians, analytics platforms, or cloud connectors are given direct connections to PLCs because it is the fastest way to get data out of the shop floor. Each of these connections is a separate path into the PLC network, and each must be individually secured, documented, and monitored.
A middleware layer changes this picture by acting as a controlled data-access layer between the OT and IT sides. Instead of multiple applications accessing the PLC network directly, they connect to the middleware via standardized, security-enabled interfaces such as OPC UA and MQTT. The middleware then handles communication with the PLC.
Softing SDEX Suite was developed specifically for this purpose. It aggregates data from Siemens SIMATIC S7-300, S7-400, S7-1200, and S7-1500 controllers, as well as from SINUMERIK CNCs, Allen-Bradley devices, and Modbus TCP devices. The data is then made available via OPC UA and MQTT with TLS/SSL encryption, authentication, and role-based access control.
Since the SDEX Suite is the only system that communicates with the PLCs on the OT side, the number of endpoints requiring direct S7comm access is reduced. For deployments that require a dedicated gateway at the boundary between the OT and IT layers, the SDEX Suite Gateway provides separate Ethernet interfaces for the respective network connections.
dataFEED OPC Suite serves the same architectural role for Windows-based OPC and OT/IT integration projects. The dataFEED OPC Suite connects SIMATIC S7 controllers and provides their data to OPC UA, OPC Classic, MQTT, REST, and database applications in a single platform. For supported S7-1200 and S7-1500 configurations, the current product supports optimized data blocks, TLS encryption, and user authentication with username and password. This enables operators to use the security functions available in newer Siemens environments instead of relying only on legacy compatibility access.
In older installations, dataFEED OPC Suite can also centralize controller access and expose data through OPC UA or other required interfaces. The secure outcome depends on network placement, configured permissions, certificate management, and restriction of direct PLC paths.
Conclusion
CISA AA26-231A highlights security vulnerabilities and access paths that have existed in many OT environments for years but can now be exploited more easily with AI-powered tools. Practical measures include identifying affected controllers, eliminating direct internet exposure, disabling unnecessary PUT/GET access, segmenting networks, and reducing the number of systems directly connected to PLCs. Centralizing access via a middleware layer such as the SDEX Suite or the dataFEED OPC Suite addresses the last point, but must be accompanied by segmentation, patching, and monitoring.