Advisories › Siemens › ICSA-26-230-02
Siemens Simcenter Nastran: 1 CVE, High 7.8
Summary
CISA reports 1 vulnerability in Siemens Simcenter Femap, Simcenter Nastran. Weakness type: Stack-based Buffer Overflow. Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.
What to do: Prioritize: Update to V2606 or later version
At a glance
- Vendor
- Siemens
- Products
- Simcenter Femap, Simcenter Nastran
- CVEs
- CVE-2026-59086
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Defense Industrial Base, Energy, Healthcare and Public Health, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-59086 | Stack-based Buffer Overflow | 7.8 | – | No | CVE-2026-59086 |
Affected products (2)
- Simcenter Femap < V2606
- Simcenter Nastran < V2606
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V2606 or later version link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-230-02
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-069220.json
- https://cert-portal.siemens.com/productcert/html/ssa-069220.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.