Semantic segmentation models are known vulnerable to small input perturbations. In this paper, we comprehensively analysis the performance of semantic segmentation models \wrt~adversarial attacks, and observe that the adversarial examples generated from a source model fail to attack the target models, \ie~the conventional attack methods, such as PGD and FGSM, do not transfer well to target models, making it necessary to study the transferable attacks, especially transferable attacks for semantic segmentation. We find that to achieve transferable attack, the attack should come with effective data augmentation and translation-invariant features to deal with unseen models, and stabilized optimization strategies to find the optimal attack direction. Based on the above observations, we propose an ensemble attack for semantic segmentation by aggregating several transferable attacks from classification to achieve more effective attacks with higher transferability. The source code and experimental results are publicly available via our project page: https://github.com/anucvers/TASS.