Siemens Flags S7-1200 PLCs in the CISA Critical-Infrastructure Campaign
Siemens updated security advisory SSB-104599 on 28 July 2026 to identify the S7-1200 PLC as a specifically named target in the campaign described by the US joint advisory AA26-097A. The underlying campaign concerns Iranian-affiliated actors targeting internet-exposed operational technology in US critical-infrastructure environments. The update is a reason to review exposure and engineering controls; it is not evidence that every S7-1200 deployment has been compromised.
The distinction matters in industrial security. A PLC is not an ordinary endpoint that can be rebooted or patched whenever convenient. Changes can affect a physical process, safety controls and availability. The right response combines fast verification with the plant's safety, change-control and operational teams.
Why the update deserves attention
Siemens says the updated advisory follows a CISA campaign warning and recommends that customers review necessary protections. The joint US advisory describes activity against internet-facing PLCs and associated engineering environments in critical sectors. In such environments, the risk is not limited to data theft: unauthorised project-file changes or misleading operator displays can create operational and safety consequences.
A safe first-day checklist for OT owners
- Confirm exposure from the asset inventory. Identify S7-1200, S7-1500 and connected engineering workstations, then verify whether any management interface, remote desktop service or PLC protocol is reachable from the public internet. Do not rely only on an external scan or an old network diagram.
- Remove direct internet access. Remote maintenance should pass through a controlled, monitored access path with strong authentication, least privilege and explicit approval—not a port-forwarding rule to a controller or engineering workstation.
- Protect engineering authority. Review privileged accounts, unique credentials, MFA where supported, vendor remote-access accounts and who can upload or change a project. Disable dormant access rather than merely documenting it.
- Validate project integrity. Compare running and approved project files under the site's change-control procedure. Keep known-good, offline-protected backups and make restoration a rehearsed, authorised operation.
- Preserve and review evidence. Retain firewall, remote-access, engineering-workstation and OT-monitoring logs. Check the official indicators and time ranges before blocking; an indicator alone needs context.
Keep IT and OT response aligned
An IT incident team may instinctively isolate a system immediately. In an OT setting, that action can itself affect a process. Establish in advance who can authorise a network change, who understands the safety impact, how operators are informed and what evidence must be preserved. Segmentation, secure remote access and tested project backups are what make an urgent response safer when a real alert arrives.