Multiple U.S. government agencies have issued a joint cybersecurity advisory warning of active threats targeting Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure sectors. The advisory, designated AA26-231A, was released on August 19, 2026, by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Energy (DOE), and the Environmental Protection Agency (EPA).
The agencies report that unattributed threat actors are exploiting known vulnerabilities and unnecessary internet exposure of Siemens S7 Series PLCs. This activity is described as coordinated reconnaissance and capability development, with the potential for future disruptive attacks. The targeted PLCs include all CPU variants of the S7-200, S7-300, S7-400, and S7-1500 series, as well as specific CPU 1211C, 1212C, 1214C, 1215C, and 1217C variants of the S7-1200 series.
Sectors most heavily affected by this activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential exposure in the Defense Industrial Base.
A significant new element highlighted in the advisory is the use of AI-generated exploitation scripts. Threat actors are reportedly leveraging artificial intelligence to build and refine these scripts more rapidly than manual development would allow. These AI-assisted tools are designed to masquerade as legitimate operational technology (OT) monitoring tools and combine publicly available open-source industrial automation libraries, such as snap7.dll and python-snap7. This enables them to read and write PLC memory, configuration data, and ladder logic programs over the S7comm protocol.
The advisory emphasizes that the use of AI dramatically lowers the technical barrier for developing functional industrial control system (ICS) exploitation tools, which previously required specialized protocol knowledge. This capability, combined with the abundance of internet-accessible devices, provides attackers with resources to test, iterate, and rapidly improve their exploits.
No specific CVE identifiers are named in the advisory. Instead, it states that threat actors can exploit various critical and high-severity known vulnerabilities if PLCs are exposed to the internet or insufficiently segmented. The advisory directs owners and operators to consult Siemens ProductCERT advisories for model and firmware-specific vulnerability details or mitigation options. The activity does not involve zero-day exploitation but rather the exploitation of known vulnerabilities, weak or default credentials, and unnecessary internet exposure.
The observed activity maps to the MITRE ATT&CK Matrix for ICS and MITRE ATT&CK Matrix for Enterprise frameworks, specifically noting reconnaissance through scanning services (T1596.005) and resource development by creating exploits for known Siemens S7 Series vulnerabilities (T1587.004).
This campaign is distinct from the Iranian-linked PLC campaign detailed in advisory AA26-097A, which was issued in April 2026. That earlier advisory covered attacks exploiting internet-exposed PLCs from Rockwell Automation, Schneider Electric, and Siemens, using vendors' own engineering software. While both advisories address threats to PLCs, the current AA26-231A focuses specifically on Siemens S7 Series devices and the novel use of AI in script generation, without attributing the activity to any named threat actor or group.
Mitigation strategies recommended by the agencies include removing Siemens S7 Series PLCs from direct internet exposure, segmenting OT from IT networks, and hardening access controls. All PLC owners and operators, regardless of vendor, are advised to apply relevant mitigations to secure their devices.
