Siemens Solid Edge: 7 CVEs, High 7.8
Summary
CISA reports 7 vulnerabilities in Siemens Solid Edge SE2025, Solid Edge SE2026. Weakness types: Out-of-bounds Read, Out-of-bounds Write, Use After Free. Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. This could allow an attacker to crash the application or execute arbitrary code. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Siemens
- Products
- Solid Edge SE2025, Solid Edge SE2026
- CVEs
- CVE-2026-50058, CVE-2026-50059, CVE-2026-50060, CVE-2026-50061, CVE-2026-50062, CVE-2026-50063, CVE-2026-50064
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-50058 | Out-of-bounds Read | 7.8 | – | No | CVE-2026-50058 |
| CVE-2026-50059 | Out-of-bounds Write | 7.8 | – | No | CVE-2026-50059 |
| CVE-2026-50060 | Use After Free | 7.8 | – | No | CVE-2026-50060 |
| CVE-2026-50061 | Use After Free | 7.8 | – | No | CVE-2026-50061 |
| CVE-2026-50062 | Out-of-bounds Read | 7.8 | – | No | CVE-2026-50062 |
| CVE-2026-50063 | Out-of-bounds Read | 7.8 | – | No | CVE-2026-50063 |
| CVE-2026-50064 | Out-of-bounds Write | 7.8 | – | No | CVE-2026-50064 |
Affected products (2)
- Solid Edge SE2025 < V225.0.15
- Solid Edge SE2026 < V226.0.7
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V225.0 Update 15 or later version link
- Vendor Fix: Update to V226.0 Update 7 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-225-12
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-621657.json
- https://cert-portal.siemens.com/productcert/html/ssa-621657.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.