Siemens Solid Edge patches file-parsing flaws
Siemens fixed seven vulnerabilities in Solid Edge that could let attackers execute code via malicious PAR, PSM, or DFT files.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Siemens has released updates for Solid Edge SE2025 and SE2026 addressing seven file-parsing vulnerabilities (CVE-2026-50058 through CVE-2026-50064). The flaws stem from out-of-bounds read/write and use-after-free conditions triggered when the application parses specially crafted PAR, PSM, or DFT files, and could allow an attacker to crash the application or execute arbitrary code in the context of the current process.
Exploitation requires a victim to open a malicious file, making this a local/client-side attack vector typical of CAD software vulnerabilities rather than a remotely exploitable network service flaw. Siemens ProductCERT reported the issues to CISA, and no active exploitation has been reported. Affected users should update to Solid Edge SE2025 V225.0 Update 15 or Solid Edge SE2026 V226.0 Update 7 or later.
This advisory is relevant to the Critical Manufacturing sector, with Solid Edge deployed worldwide. CISA's standard recommendations apply: minimize network exposure of control system devices, isolate ICS networks from business networks, and use secure remote access methods such as VPNs where necessary.
Mentioned in this report
Detection guidance
Solid Edge Processing Malicious CAD File
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Solid Edge opening specially crafted PAR, PSM, or DFT files that trigger file-parsing vulnerabilities leading to crash or code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Solid Edge Processing Malicious CAD File
description: Detects Solid Edge (sldworks.exe or related process) opening or processing
PAR, PSM, or DFT files - file-parsing vulnerability exploitation vector. This rule
is designed to catch the opening of potentially malicious CAD files that trigger
CVE-2026-50058 through CVE-2026-50064 vulnerabilities.
tags:
- attack.initial-access
- attack.t1204.002
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \sldworks.exe
- \solid.exe
TargetFilename|endswith:
- .par
- .psm
- .dft
filter_legitimate_workspace:
TargetFilename|contains:
- \Program Files
- \ProgramData
condition: selection and not filter_legitimate_workspace
falsepositives:
- Legitimate engineering workflows opening CAD files from shared project directories
- Automated CAD file processing by batch scripts in manufacturing environments
level: medium
id: e7cbc95c-2bbf-5681-a7ea-893aaee6f298
status: experimental
author: Vorant
Suspicious Child Process Spawned by Solid Edge
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Solid Edge spawning unexpected child processes - potential code execution following successful file-parsing vulnerability exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Solid Edge
description: Detects Solid Edge spawning child processes such as cmd.exe, powershell.exe,
or rundll32.exe - potential code execution from parsing malicious CAD file via out-of-bounds
or use-after-free vulnerability.
tags:
- attack.initial-access
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \sldworks.exe
- \solid.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \rundll32.exe
- \msiexec.exe
- \regsvcs.exe
filter_solid_edge_plugins:
CommandLine|contains:
- help
- /?
condition: selection and not filter_solid_edge_plugins
falsepositives:
- Solid Edge plugins or extensions spawning system utilities for legitimate CAD operations
- Third-party integrations (e.g., PDM or PLM systems) invoking command-line tools
from Solid Edge context
level: high
id: 35ac89b5-ff6a-5733-8292-3d532b6239cc
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-12
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs