# Siemens Solid Edge parsing vulnerabilities allow arbitrary code execution

Published: 2026-05-14 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/9aadc9c4-b348-5f40-bd8e-421f21a81b1e/siemens-solid-edge-parsing-vulnerabilities-allow-arbitrary-code-execution

> Two file parsing flaws in Siemens Solid Edge SE2026 allow arbitrary code execution via crafted PAR files; patch to Update 5 immediately.

Siemens Solid Edge SE2026 before Update 5 contains two vulnerabilities in its PAR file parser that allow attackers to crash the application or execute arbitrary code in the context of the application process. CVE-2026-44411 involves uninitialized pointer access (CWE-824) while parsing specially crafted PAR files, and CVE-2026-44412 is a stack-based buffer overflow (CWE-121) triggered by the same mechanism. Both vulnerabilities require a user to open a malicious PAR file.

Affected versions are Siemens Solid Edge versions prior to V226.0 Update 5. The vulnerabilities impact critical manufacturing infrastructure globally. Siemens has released Update 5 as the remediation, and no evidence of active exploitation in the wild is documented in this advisory.

Defenders should prioritize patching Solid Edge installations, particularly those in manufacturing environments. The attack requires file interaction, reducing but not eliminating risk in air-gapped or restricted-access environments. Deployment behind firewalls and network segmentation are recommended to minimize exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-44411, CVE-2026-44412

## Detection guidance (public sample)

### Solid Edge Process Spawning Command Interpreter or LOLBin

ATT&CK: T1204.002

Solid Edge (Edge.exe) spawning shells, script hosts or common LOLBins, which is consistent with code execution after a malicious PAR file triggers a parser memory-corruption bug. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Process Spawning Command Interpreter or LOLBin
description: Detects the Solid Edge main process (Edge.exe) launching shells, script
  hosts or common living-off-the-land binaries. CAD software rarely does this, so
  it may indicate exploitation of PAR parser flaws (CVE-2026-44411 / CVE-2026-44412)
  after a user opens a crafted file.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \Solid Edge
    ParentImage|endswith: \Edge.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Custom Solid Edge macros or add-ins that call cmd.exe or PowerShell for automation
- Siemens installer or update helpers launching msiexec from the Solid Edge process
level: high
id: ca7175ae-4f68-5628-839f-8cf23c176701
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03
```

### Solid Edge Outbound SMB Connection to Non-Private Address

ATT&CK: T1187

Solid Edge (Edge.exe) connecting to SMB (445) on a non-RFC1918 address, which may indicate a crafted file forcing NTLM authentication to an external host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Outbound SMB Connection to Non-Private Address
description: Detects Edge.exe from a Solid Edge install initiating a connection to
  TCP 445 on a public address. A crafted CAD file or post-exploitation activity could
  trigger this to coerce NTLM authentication. Hunting-grade rule that needs environment
  context.
tags:
- attack.credential-access
- attack.t1187
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: \Solid Edge
    Image|endswith: \Edge.exe
    DestinationPort: 445
    Initiated: 'true'
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
    - ::1/128
    - fe80::/10
    - fc00::/7
  condition: selection and not filter_private
falsepositives:
- Solid Edge accessing Teamcenter or file shares over a VPN or routed public-range
  addressing
- Organisations that use public IP space internally for file servers
level: medium
id: 8c61bae1-b91f-5831-bbab-050c9891e34f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03
```

### Solid Edge Opening PAR File From Download or Temp Location

ATT&CK: T1204.002

Solid Edge launched with a .par file from a user download, temp or mail-attachment cache path, the delivery mechanism needed to exploit the PAR parsing vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Opening PAR File From Download or Temp Location
description: Detects Edge.exe started with a .par file argument located in Downloads,
  Temp, or Outlook attachment cache folders. Both PAR parser vulnerabilities require
  a user to open a malicious file, so this is a low-fidelity hunting indicator of
  untrusted file opening.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains: \Solid Edge
    Image|endswith: \Edge.exe
  selection_file:
    CommandLine|contains: .par
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Content.Outlook\
    - \INetCache\
  condition: all of selection_*
falsepositives:
- Engineers legitimately opening PAR files received from suppliers and saved to Downloads
- Files opened directly from zip archives extracted to Temp
level: low
id: 9d402f98-f370-5821-9e8d-ca95a2855545
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9aadc9c4-b348-5f40-bd8e-421f21a81b1e/siemens-solid-edge-parsing-vulnerabilities-allow-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup