CISA, NSA, the FBI, DOE and EPA released AA26-231A on 19 August 2026, warning of an active threat to Siemens S7 Series PLCs. Check these first: which S7 controllers are reachable, whether TCP port 102 is blocked at the perimeter, whether protection levels and passwords are set, and who can write to controller memory.
What the alert describes
The alert does not name the actors. It describes reconnaissance and capability development against US based S7 installations. According to the agencies, the actors used internet scanning services such as Censys and ZoomEye to find exposed or poorly segmented controllers, targeted outdated or weakly protected devices, and built Python scripts on the open source python-snap7 library to read and write PLC memory, configuration data and ladder logic over S7comm.
It adds that the actors used AI to generate and iterate scripts, and disguised the scripts as legitimate OT monitoring tools. The reads and writes were assessed as likely reconnaissance, capability testing and pre-positioning. Targeted models include S7-200, S7-300, S7-400, S7-1200 and S7-1500, including F series safety controllers. Sectors named are critical manufacturing, energy, water, chemical, food and agriculture and commercial facilities.
Checklist from the mitigations
Inventory
- List every S7 PLC and compare firmware with gold copy backups.
- Find any that are reachable from untrusted networks.
- Map engineering workstations.
Patch
- Update PLC firmware, TIA Portal and STEP 7, starting with internet facing and DMZ devices, testing first.
Segment
- Block TCP port 102 at perimeter firewalls.
- Keep a DMZ between OT and IT, and confirm no unauthorised routing exists.
Access control
- Restrict engineering access by MAC or IP allowlist.
- Turn on PLC password and protection levels.
- Remove default SNMP community strings.
- Use application allowlisting and MFA for remote OT access.
Monitoring
- Use ICS aware intrusion detection.
- Watch S7comm traffic for unauthorised writes.
- Log engineering connections.
- Look for snap7.dll on systems that are not engineering stations.
Hardening
- Disable unneeded web servers and protocols, limit simultaneous sessions, enable the protection features the vendor documents, and monitor for ladder logic changes.
Vendor
- Work with the vendor on model specific hardening, and report incidents to CISA, the FBI and the vendor's product security team.
Beyond one vendor
The alert says the risk extends to PLCs in general and asks owners to share the guidance with integrators and managed service providers that have remote access. Apply the same list to any controller family you run.
Assign owners and dates
Turn the checklist into tickets: one owner per heading, a due date, and a status. Start with the exposure and port 102 checks, because they take hours, not weeks. Report back to plant management after the first pass, and add S7 specific items to your change and commissioning checklists.
Quick check
Does this apply only to Siemens users?
The alert focuses on S7 controllers, but says the risk extends to PLCs generally. The checklist transfers to other brands.
What is the first action?
Find out whether any controller is reachable from untrusted networks, then block the S7comm port at the perimeter.
Sources
Last reviewed: 19 October 2026.
