CISA, NSA, and Partners Issue Joint Cybersecurity Advisory on Threat Activity Targeting Siemens S7 Series PLCs Across Multiple U.S. Critical Infrastructure Sectors
08/19/2026 11:30 AM EST
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) have issued a joint Cybersecurity Advisory warning of threat activity targeting Siemens S7 Series programmable logic controllers (PLCs) across U.S. critical infrastructure, Defending Against an Active Threat to Siemens S7 Series PLCs. The sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. Successful exploitation could disrupt critical industrial processes and cause safety incidents, equipment damage, sensitive data compromises, compliance violations, and cascading impacts across interconnected systems.
The advisory details cyber threat actors using AI-generated exploitation scripts disguised as legitimate monitoring tools and leveraging internet scanning services to find exposed PLCs vulnerable to exploitation. Organizations using Siemens S7 Series PLCs should inventory devices, apply critical patches, ensure PLCs are not accessible from the internet, strengthen access controls, monitor for unauthorized activity, harden PLC services and protocols, and hunt for anomalies that may indicate compromise.
Organizations should also assess exposure across all PLCs and operational technology (OT) devices in their environments. Although this advisory focuses on Siemens S7 Series PLCs, the broader risk to OT devices, including PLCs, extends beyond Siemens products to other manufacturer devices.
Read more: Defending Against an Active Threat to Siemens S7 Series PLCs | CISA
SWHSP