CVE-2026-85114 & CVE-2026-85115: Siemens SIMATIC S7 Webserver API .NET Client Library — Detection, Containment, and Patch Guide

---
title: DOTNET Client Path Traversal File Write Outside Download Directory
id: 8b4e7a11-6c2f-4c5a-9f1c-2a7d8e9f0011
status: experimental
description: Detects .NET or application processes creating files using traversal sequences outside approved download locations, consistent with CVE-2026-85114 impact in a client library.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_traversal:
    TargetFilename|contains:
      - '..\\'
      - '../'
      - '%2e%2e'
      - '%252e%252e'
  selection_runtime:
    Image|endswith:
      - '\\dotnet.exe'
      - '\\w3wp.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
  filter_approved_paths:
    TargetFilename|startswith:
      - 'C:\\Program Files\\Siemens\\'
      - 'C:\\OT-Downloads\\'
      - 'D:\\S7-Downloads\\'
  condition: selection_traversal and selection_runtime and not filter_approved_paths
falsepositives:
  - Legitimate installers, updaters, backup agents, and document processing; replace the approved paths with environment-specific download directories.
level: high
---
title: Encoded Traversal or Sensitive Error Strings in Web Logs Toward OT Assets
id: 6f1d9c44-8a20-4c30-b91a-7c6d2e5f0022
status: experimental
description: Detects HTTP request or proxy telemetry containing traversal sequences or verbose error disclosure headed toward identified SIMATIC S7 webserver or OT gateway addresses.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '%252e%252e'
    sc-status:
      - 400
      - 500
  selection_body:
    cs-bytes|gt: 0
  condition: selection_uri or selection_body
falsepositives:
  - Vulnerability scanners and broken application routing; scope to OT webserver hosts and alert only on repeated patterns or paths tied to download endpoints.
level: medium

// Hunt 1: file writes with traversal semantics outside approved download roots
let approved_roots = dynamic(['C:\\OT-Downloads\\','D:\\S7-Downloads\\']);
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName contains '..' or FolderPath contains '..\\' or FolderPath contains '../'
| where not(FolderPath has_any (approved_roots))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA256
| order by TimeGenerated desc;

// Hunt 2: web/proxy/syslog telemetry with traversal or server-error disclosure toward OT hosts
let ot_hosts = dynamic(['s7-web','plc','simatic','10.10.0.0/16']);
union isfuzzy=true (CommonSecurityLog, Syslog)
| where TimeGenerated > ago(14d)
| extend msg = coalesce(Message, AdditionalExtensions, Computer)
| where msg has_any ('../','..\\','%2e%2e','%252e%252e','stack trace','exception','Internal Server Error')
| where msg has_any (ot_hosts) or DestinationIP has_any ('10.10.','172.16.','192.168.')
| project TimeGenerated, Computer, SourceIP, DestinationIP, DestinationPort, Message
| order by TimeGenerated desc;

// Hunt 3: unexpected client processes connecting to likely S7 webserver ports from workstation VLANs
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (80,443,8080)
| where RemoteIP has_any ('10.10.','172.16.','192.168.')
| where InitiatingProcessFileName in~ ('dotnet.exe','w3wp.exe','powershell.exe','pwsh.exe') or InitiatingProcessCommandLine has_any ('s7','simatic','webserver','download')
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Connections desc;

-- Hunt workstations and jump hosts for traversal-style writes plus network reachability to OT web endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(s7|simatic|webserver|download)'
   OR Exe =~ '(?i)(dotnet|w3wp|powershell|pwsh)'

SELECT Time=uint(epoch=now()), FullPath, Size, ModTime
FROM glob(globs='C:/**', accessor='ntfs')
WHERE FullPath =~ '(?i)(\.\.|%2e%2e)' AND NOT FullPath =~ '(?i)^C:\\(OT-Downloads|Program Files\\Siemens)\\'
LIMIT 200

SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemotePort in (80,443,8080)
  AND (RemoteAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)')

# Inventory likely affected .NET client library usage without changing OT state
$roots = @('C:\Program Files','C:\Program Files (x86)','C:\inetpub','D:\','C:\Users')
$hits = foreach ($root in $roots) {
  if (Test-Path $root) {
    Get-ChildItem $root -Recurse -File -ErrorAction SilentlyContinue |
      Where-Object { $_.Name -match 's7|simatic|webserver|siemens' -or $_.Extension -in '.dll','.exe' } |
      ForEach-Object {
        $v = $_.VersionInfo
        [pscustomobject]@{
          Host=$env:COMPUTERNAME; Path=$_.FullName; Product=$v.ProductName; Company=$v.CompanyName;
          FileVersion=$v.FileVersion; ProductVersion=$v.ProductVersion; LastWrite=$_.LastWriteTime
        }
      }
  }
}
$hits | Where-Object { $_.Company -match 'Siemens' -or $_.Product -match 'SIMATIC|S7|Webserver' } | Export-Csv C:\s7_client_inventory.csv -NoTypeInformation

# Flag package references and assembly versions below the CISA-listed ranges
Get-ChildItem C:\,D:\ -Recurse -Filter packages.config -ErrorAction SilentlyContinue | Select-String -Pattern 'SIMATIC|S7|Webserver' -List | Select-Object Path,Line
Get-ChildItem C:\,D:\ -Recurse -Filter *.csproj -ErrorAction SilentlyContinue | Select-String -Pattern 'PackageReference|SIMATIC|S7|Webserver' -List | Select-Object Path,Line

# Hard blast radius on known download directories: deny writes except for the service account
$svc = 'DOMAIN\svc-s7client'
$dir = 'D:\S7-Downloads'
if (Test-Path $dir) { icacls $dir /inheritance:r /grant:r ('{0}:(OI)(CI)M' -f $svc) /deny 'Users:(OI)(CI)W' }