Five US agencies warn of active attacks on Siemens S7 controllers

The NSA, CISA, the FBI, the US Department of Energy and the Environmental Protection Agency published a joint advisory on 19 August 2026 to owners and operators of industrial control systems. The advisory, coded AA26-231A, concerns an active threat to programmable logic controllers in the Siemens S7 series, and the agencies describe it as an urgent matter. At its core is the finding that S7 controllers reachable from the internet face a high probability of attack, because known vulnerabilities, publicly accessible exploitation libraries and AI assisted development tools together lower the barrier for the attacker. The advisory covers several sectors, among them chemical facilities, commercial buildings, critical manufacturing, the defence industrial base, energy, food and agriculture, and water and wastewater. The agencies stress that this is an active threat, not a theoretical risk.

What happens technically

A programmable logic controller is the computer that performs the actual control in a plant, meaning the one that starts and stops pumps, opens valves and keeps a process within its limits. The Siemens S7 series is among the most widespread in industry. Devices of this kind are built for operational reliability across many years, and the protocols they use come from a time when the network around them was closed. Authentication is therefore weak or absent in many deployments, and a device reachable directly from the internet can often be controlled by whoever finds it.

What is new in the advisory is not the vulnerabilities themselves, but the combination the agencies point to. Exploitation code for known weaknesses sits publicly available in libraries and toolkits, so the attacker does not have to develop anything. AI assisted development tools lower the barrier further, because they make it faster to assemble and adapt code for a specific target. This is the same development described in attack campaigns over the past year, where agent based setups searched out targets and pulled ready made exploit code from open sources. The consequence is that the time from a device being exposed to it being found and attacked grows shorter. The agencies therefore ask everyone operating this kind of equipment to put protective measures in place quickly.

What this means for you if you run S7 controllers

The sector list reaches industry and municipal technical operations broadly, and S7 controllers recur in the plants we meet. What separates this case from an ordinary vulnerability story is that the consequence is physical. A compromised controller is not about data going astray, but about a process being stopped, altered or driven outside its limits. For a commercial building that can mean ventilation and heating, for a water plant it can mean dosing, and for a production line it can mean a halt in production.

Our assessment is that the decisive question is shorter than the advisory itself. Are any of your S7 controllers reachable from the internet, directly or through a supplier modem. A great many organisations cannot answer that without checking, because the equipment was set up by a supplier and never made it into the asset inventory. NIS2 covers several of the sectors named. Whether an entity is covered, and whether it is essential or important, depends on its type and size. In Norway, NIS2 has not yet been implemented. For an entity covered by NIS2, the Article 21 requirements for risk management, access control and incident handling apply to the automation side of the business too, not only office IT.

Berigo recommends

• Check from the outside whether S7 controllers are reachable from the internet, and review firewall rules and supplier connections at the same time.
• Take the controllers off the internet, and route remote access through a VPN or gateway with strong authentication.
• Record every controller in the asset inventory with model and firmware version, so the next advisory can be answered in hours rather than weeks.
• Treat the advisory as an emergency change, and prioritise known vulnerabilities in the equipment together with the supplier.
• Log and monitor traffic towards the control network, and rehearse manual operation should the controller have to be disconnected.