CISA reports two vulnerabilities in LOGO! Soft Comfort versions before V9 and cites Siemens’ recommendation to update software and hardware.
What to know
- CISA reports two vulnerabilities in Siemens LOGO! Soft Comfort versions earlier than V9.
- A local attacker could extract a hardcoded encryption key, decrypt project files, or remove project passwords.
- Unsalted password hashes could enable offline dictionary or brute-force attacks if an attacker obtains a project file.
- Siemens recommends updating LOGO! Soft Comfort to V9 or later. A LOGO! V9 BM or later hardware upgrade is also required to avoid compatibility mode, where the vulnerabilities remain present.
What CISA reported
The Cybersecurity and Infrastructure Security Agency (CISA) published an ICS Advisory about multiple vulnerabilities in Siemens LOGO! Soft Comfort.
CISA identifies the affected product as LOGO! Soft Comfort earlier than V9. The advisory lists CVE-2026-57262 and CVE-2026-57263. Both vulnerabilities have a CVSS v3.1 base score of 6.8 and a medium severity rating.
How the vulnerabilities work
For CVE-2026-57262, CISA says affected products use a static, hardcoded AES master key to encrypt project files. A local attacker could extract the key from application files or memory, then decrypt project files or remove project passwords without knowing the user-defined password.
For CVE-2026-57263, CISA says project passwords are stored as unsalted SHA-256 hashes. If an attacker obtains a project file, the attacker could perform efficient offline dictionary or brute-force attacks against the hash.
CISA says successful exploitation could result in unauthorized access to, or modification of, sensitive project logic and configurations.
Affected environments and update guidance
CISA lists commercial facilities and transportation systems among the relevant critical-infrastructure sectors and says the products are deployed worldwide. Organizations should first confirm whether Siemens LOGO! Soft Comfort is installed and identify its version.
According to CISA’s republication of the Siemens ProductCERT advisory, Siemens recommends updating LOGO! Soft Comfort to V9 or later. A hardware upgrade to LOGO! V9 BM or later is also required to avoid compatibility mode, in which the vulnerabilities addressed by the advisory remain present.
CISA recommends performing an impact analysis and risk assessment before deploying defensive measures. Organizations should follow applicable change-management procedures and the product manuals when planning updates to operational control systems.
CISA’s defensive recommendations
CISA recommends minimizing network exposure for control-system devices and ensuring they are not accessible from the internet. It also recommends placing control-system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, CISA recommends more secure methods such as virtual private networks (VPNs), while noting that VPNs may have vulnerabilities and should be updated to the most recent available version. CISA also advises organizations to follow established internal procedures when investigating suspected malicious activity and to report findings to CISA.
Does this affect me?
- Who may be affected
- Technicians
- How to check
- Confirm whether you use the named product, service, version, or account described by the primary source.
- What to do
- Follow the vendor or agency guidance that applies to your environment; prioritize confirmed updates and account protections.
- What to avoid
- Do not install unsolicited fixes, call numbers from pop-ups, or assume every device is affected.
Common questions
Does this affect every computer or account?
No. Exposure depends on the affected product, version, configuration, or service described by the primary source.
What is the safest first step?
Verify the product or account involved and use the official source or vendor update path rather than links from unsolicited messages.
Primary source
Source: CISA, “Siemens LOGO! Soft Comfort,” ICS Advisory ICSA-26-225-13, published August 13, 2026. CISA says the advisory is a verbatim republication of Siemens ProductCERT advisory SSA-751328. Full advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-13 Read the complete original source.
Get the important updates without the noise
Choose the devices and topics you care about in Cyber Alerts.
Article history: Published Aug 13, 2026 at 7:18 pm EDT. Updates and corrections are noted here when material facts change.
