Siemens patches seven Solid Edge file-parsing RCEs
All seven are AV:L and require user interaction, but Solid Edge runs on engineering workstations in defense supply chains where one malicious attachment is the whole attack.
TL;DR
CISA issued an advisory Tuesday covering seven remote code execution vulnerabilities in Siemens Solid Edge, triggered when the CAD application parses malicious PAR, PSM, or DFT files. Affected versions are SE2025 before v225.0.15 and SE2026 before v226.0.7. Siemens has released patches for both branches, update to v225.0.15 and v226.0.7 respectively. All seven carry a CVSS 3.1 score of 7.8 with a local attack vector; exploitation requires user interaction.
Siemens Solid Edge has become a recurring entry on CISA's ICS advisory feed. This latest covers seven distinct file-parsing vulnerabilities (a mix of out-of-bounds reads (CVE-2026-50058, CVE-2026-50062, CVE-2026-50063), out-of-bounds writes (CVE-2026-50059, CVE-2026-50064), and use-after-free bugs (CVE-2026-50060, CVE-2026-50061)) all triggered when the application opens a specially crafted DFT, PAR, or PSM file.
None of the seven carries a network attack vector. Every CVE is AV:L, meaning the attacker needs local access or must convince a user to open a malicious file. But for defense contractors and manufacturers running Solid Edge on engineering workstations, it's often just one email attachment between an attacker and code execution with full process privileges.
The fix is straightforward: update SE2025 to v225.0.15 and SE2026 to v226.0.7. Siemens has published both through its support portal. Organizations that can't patch immediately should restrict Solid Edge file handling to trusted sources and treat unsolicited PAR, PSM, and DFT attachments as hostile.
Published ·Deep Fathom