Which versions of SIMATIC S7-PLCSIM Advanced are affected by CVE-2026-54429?

Siemens SIMATIC S7-PLCSIM Advanced is vulnerable to denial of service attacks accessible from adjacent network segments that exhaust memory and force service restarts, disrupting industrial control…

How to fix or mitigate CVE-2026-54429?

Within 24 hours, identify and inventory all SIMATIC S7-PLCSIM Advanced installations and document their network connectivity; within 7 days, implement network segmentation to isolate development systems hosting affected instances and apply ingress traffic rate limiting and multicast filtering on those network segments; within 30 days, subscribe to Siemens ProductCERT notifications for patch release tracking, establish version-specific patch deployment procedures, and document manual restart recovery protocols to minimize downtime from denial of service incidents.

SIMATIC S7-PLCSIM Advanced CVE-2026-54429

Q: What is the CVSS score of CVE-2026-54429?

CVE-2026-54429 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43649 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 siemens

GHSA-xhg3-q2f6-w8cg

Denial Of Service Siemens Simatic S7 Plcsim Advanced

6.0

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

6.0 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent unauthenticated flood (AV:A/PR:N); impact confined to the crashing application which restarts with no data loss, so S:U and only A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 14, 2026 - 10:22 NVD

HIGH MEDIUM

CVSS changed

Jul 14, 2026 - 10:22 NVD

7.4 (HIGH) 6.0 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 10:16 vuln.today

CVE Published

Jul 14, 2026 - 09:19 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected application becomes inaccessible and requires a manual restart; no project data is lost. Successful exploitation requires a specific project configuration to be already active on the targeted instance.

AnalysisAI

Denial of service in Siemens SIMATIC S7-PLCSIM Advanced (all versions) allows an unauthenticated attacker on the same local network segment to exhaust the application's memory by flooding it with high-volume multicast traffic, rendering the PLC simulation instance inaccessible until manually restarted. Exploitation is limited to instances running a specific active project configuration, and no project data is lost. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

SIMATIC S7-PLCSIM Advanced is a Windows-based simulation tool that emulates SIMATIC S7-1500 and ET 200SP PLCs for virtual commissioning, testing, and engineering of automation projects. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the application ingests multicast network frames without bounding the memory allocated to buffer or process them, so a sustained high-volume multicast stream drives unbounded allocation until available memory is exhausted and the simulation crashes or hangs. The affected component is the network-facing simulation runtime identified by CPE cpe:2.3:a:siemens:simatic_s7-plcsim_advanced, and the multicast handling is only reachable when a project configuration that enables that traffic path is actively loaded.

RemediationAI

No fixed version is specified in the available data; because all versions are listed as affected, treat this as no vendor-released patch version identified at time of analysis and consult Siemens advisory SSA-828211 (https://cert-portal.siemens.com/productcert/html/ssa-828211.html) for the authoritative fixed release and mitigation guidance. As compensating controls, restrict SIMATIC S7-PLCSIM Advanced instances to trusted, isolated engineering/simulation network segments and apply network segmentation and firewalling per Siemens' operational guidelines for industrial security, since the attack requires presence on the local segment; where feasible, block or rate-limit multicast traffic reaching the simulation host (trade-off: this can break legitimate PLC discovery and multicast-based project features that rely on that traffic). Avoid running the specific project configuration that enables the vulnerable path on exposed segments if it is not operationally required, and monitor for the crash condition since recovery only requires a manual restart with no data loss.