VORANT. Threat Intelligence Research Sign in Create a free account

Siemens Solid Edge parsing vulnerabilities allow arbitrary code execution

routine vulnerability manufacturing

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Two file parsing flaws in Siemens Solid Edge SE2026 allow arbitrary code execution via crafted PAR files; patch to Update 5 immediately.

Siemens Solid Edge SE2026 before Update 5 contains two vulnerabilities in its PAR file parser that allow attackers to crash the application or execute arbitrary code in the context of the application process. CVE-2026-44411 involves uninitialized pointer access (CWE-824) while parsing specially crafted PAR files, and CVE-2026-44412 is a stack-based buffer overflow (CWE-121) triggered by the same mechanism. Both vulnerabilities require a user to open a malicious PAR file.

Affected versions are Siemens Solid Edge versions prior to V226.0 Update 5. The vulnerabilities impact critical manufacturing infrastructure globally. Siemens has released Update 5 as the remediation, and no evidence of active exploitation in the wild is documented in this advisory.

Defenders should prioritize patching Solid Edge installations, particularly those in manufacturing environments. The attack requires file interaction, reducing but not eliminating risk in air-gapped or restricted-access environments. Deployment behind firewalls and network segmentation are recommended to minimize exposure.

Mentioned in this report

Vulnerabilities CVE-2026-44411CVE-2026-44412

Related reporting

Detection guidance

Solid Edge Process Spawning Command Interpreter or LOLBin

ATT&CK T1204.002

Solid Edge (Edge.exe) spawning shells, script hosts or common LOLBins, which is consistent with code execution after a malicious PAR file triggers a parser memory-corruption bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Solid Edge Process Spawning Command Interpreter or LOLBin
description: Detects the Solid Edge main process (Edge.exe) launching shells, script
  hosts or common living-off-the-land binaries. CAD software rarely does this, so
  it may indicate exploitation of PAR parser flaws (CVE-2026-44411 / CVE-2026-44412)
  after a user opens a crafted file.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \Solid Edge
    ParentImage|endswith: \Edge.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Custom Solid Edge macros or add-ins that call cmd.exe or PowerShell for automation
- Siemens installer or update helpers launching msiexec from the Solid Edge process
level: high
id: ca7175ae-4f68-5628-839f-8cf23c176701
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03

Solid Edge Outbound SMB Connection to Non-Private Address

ATT&CK T1187

Solid Edge (Edge.exe) connecting to SMB (445) on a non-RFC1918 address, which may indicate a crafted file forcing NTLM authentication to an external host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Solid Edge Outbound SMB Connection to Non-Private Address
description: Detects Edge.exe from a Solid Edge install initiating a connection to
  TCP 445 on a public address. A crafted CAD file or post-exploitation activity could
  trigger this to coerce NTLM authentication. Hunting-grade rule that needs environment
  context.
tags:
- attack.credential-access
- attack.t1187
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: \Solid Edge
    Image|endswith: \Edge.exe
    DestinationPort: 445
    Initiated: 'true'
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
    - ::1/128
    - fe80::/10
    - fc00::/7
  condition: selection and not filter_private
falsepositives:
- Solid Edge accessing Teamcenter or file shares over a VPN or routed public-range
  addressing
- Organisations that use public IP space internally for file servers
level: medium
id: 8c61bae1-b91f-5831-bbab-050c9891e34f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03

Solid Edge Opening PAR File From Download or Temp Location

ATT&CK T1204.002

Solid Edge launched with a .par file from a user download, temp or mail-attachment cache path, the delivery mechanism needed to exploit the PAR parsing vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Solid Edge Opening PAR File From Download or Temp Location
description: Detects Edge.exe started with a .par file argument located in Downloads,
  Temp, or Outlook attachment cache folders. Both PAR parser vulnerabilities require
  a user to open a malicious file, so this is a low-fidelity hunting indicator of
  untrusted file opening.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains: \Solid Edge
    Image|endswith: \Edge.exe
  selection_file:
    CommandLine|contains: .par
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Content.Outlook\
    - \INetCache\
  condition: all of selection_*
falsepositives:
- Engineers legitimately opening PAR files received from suppliers and saved to Downloads
- Files opened directly from zip archives extracted to Temp
level: low
id: 9d402f98-f370-5821-9e8d-ca95a2855545
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs