Solid Edge CVEs: Patch SE2025 and SE2026 File RCE Flaws

CISA republished Siemens ProductCERT advisory SSA-621657 on August 13, after Siemens’ August 11 publication, covering CVE-2026-50058 through CVE-2026-50064. Siemens rates the collection 7.8 under CVSS v3 and says specially crafted files can crash Solid Edge or allow arbitrary code execution when the software reads them. Organizations running Solid Edge SE2025 below version 225.0.15 or SE2026 below version 226.0.7 should treat this as a workstation patching task with a file-handling component, not merely another industrial-network advisory.

The practical exposure is straightforward: a malicious model or drawing must reach a user and be opened, previewed, imported, or otherwise parsed by a vulnerable Solid Edge installation. That makes emailed design packages, supplier exchanges, shared Windows folders, PLM-connected repositories, removable media, and downloaded sample files more relevant to this issue than an internet-facing Solid Edge service.

The vulnerable files are part of normal Solid Edge work​

The file types named in the advisory are not obscure interchange artifacts. Siemens documentation identifies .par as a Solid Edge part-document format, .psm as a sheet-metal document format, and .dft as a draft-document format. Its own tools also list those extensions among the normal file types that users can select through Solid Edge’s file-open workflow.

That makes the user-interaction requirement meaningful but not reassuring. A security flaw that requires someone to open an unfamiliar executable is easier to isolate than one that sits inside the product’s routine engineering documents. CAD users are expected to receive revisions, inspect vendor parts, reuse legacy drawings, and open files from partners; those are precisely the business processes in which provenance can become unclear.

Siemens describes the underlying defects as out-of-bounds reads, out-of-bounds writes, and use-after-free conditions. Those are memory-safety failures: the application can be induced to read or write memory outside valid boundaries, or to access memory after it should no longer be available. A crash is the most visible result, but successful exploitation can give an attacker code execution in the context of the Solid Edge process.

For a typical Windows desktop deployment, that means the attacker’s foothold would be limited initially by the permissions of the engineer, designer, or operator who opened the file. It does not automatically mean domain-wide compromise. But users of engineering workstations often have access to proprietary designs, network shares, manufacturing documentation, license services, project-management systems, and synchronized cloud storage. A compromise of that account can therefore expose considerably more than the one file that delivered the exploit.

The version thresholds are the details administrators must verify​

Siemens’ advisory identifies two affected release lines:

• Solid Edge SE2025 is affected at versions below 225.0.15.
• Solid Edge SE2026 is affected at versions below 226.0.7.

The important operational point is that these are strict less-than thresholds. A team cannot safely assume that “we are on Solid Edge 2025” or “we installed the current year’s release” is sufficient. The installed maintenance level must meet or exceed the applicable number, and administrators should confirm the result on systems that use packaged deployments, golden images, virtual desktops, or application-layering tools.

The CISA republication preserves Siemens’ machine-readable version notation rather than translating it into a friendlier “Update” label. That avoids a potentially dangerous assumption: the advisory itself does not say that every package named similarly in a download portal corresponds exactly to the number displayed in the CSAF record. IT teams should compare the application’s installed version directly with 225.0.15 or 226.0.7, then obtain the current supported Siemens release through their normal software-support channel.

This is also an update where mixed environments deserve attention. Engineering departments frequently preserve an older release for compatibility with a customer project, a validated add-in, a macro set, a manufacturing workflow, or a document-management integration. A clean upgrade in one pilot group does not protect a second workstation pool that continues to open the same .par, .psm, or .dft files with an older Solid Edge build.

Seven CVEs, one file-delivery problem​

CVE-2026-50058, CVE-2026-50059, CVE-2026-50060, CVE-2026-50061, CVE-2026-50062, CVE-2026-50063, and CVE-2026-50064 are grouped in the same Siemens advisory and share the same affected-version ranges. The published material does not map each individual CVE to a particular file extension or memory-corruption class, so defenders should not attempt to build narrow rules around one extension or one CVE number.

That omission matters for triage. If an organization blocks .par files at an email gateway but continues to accept .psm and .dft attachments from unverified senders, it has not followed the advisory’s exposure model. Likewise, routing a document through a different department does not make it safe if it will later be opened by a vulnerable Solid Edge endpoint.

Siemens has released fixes, rather than leaving customers with a workaround-only posture. The advisory’s central recommendation is to update to the latest available version. It does not publish a temporary configuration switch that disables the vulnerable parsers, nor does it identify a safe subset of the affected extensions to keep opening before patching.

That is a material distinction for change managers. If the affected machine must keep running Solid Edge before the update can be deployed, the available compensating control is to reduce trust in incoming native Solid Edge documents—not to assume that perimeter networking controls will prevent exploitation.

CISA’s industrial guidance is useful, but the first control is on the Windows client​

CISA classifies the advisory under Critical Manufacturing and repeats its standard advice on reducing network exposure, segmentation, firewalls, VPN maintenance, and risk assessment. Those measures remain sound operational-security practice, particularly where CAD workstations are connected to factory systems or remote-access infrastructure.

But this advisory describes a malicious-file parsing path. The decisive control is the patched Solid Edge executable on the machine that processes the document. A firewall does not prevent a user from opening an attachment already stored on a mapped drive; network segmentation does not repair a vulnerable parser; and a VPN update does not stop a poisoned file sent by an authenticated supplier account.

Administrators should therefore split the response into immediate containment and durable remediation:

• Inventory every workstation, VDI image, and shared engineering host running Solid Edge SE2025 or SE2026, then compare the installed version against Siemens’ stated thresholds.
• Deploy the Siemens update through the organization’s established software-distribution process and verify the installed version after deployment rather than relying only on a successful installer exit code.
• Temporarily require provenance checks for externally sourced .par, .psm, and .dft files on systems awaiting remediation, especially files received through email, ad hoc transfer services, supplier portals, or personal cloud-storage links.
• Review automated workflows that may open or process Solid Edge documents under service accounts, because a noninteractive conversion or document-ingestion task can have access to broader shared storage than a normal user session.
• Preserve suspicious files and relevant endpoint telemetry instead of repeatedly reopening a document that crashes Solid Edge, since a crash may be the visible symptom of an attempted exploit.

The advisory does not report active exploitation, and neither Siemens nor CISA identifies a public proof-of-concept in the material published with SSA-621657. That absence should not be mistaken for a lower-priority defect: reliable exploitation development often follows public disclosure, particularly when the vulnerable parser and affected file formats are clearly named.

Why CAD teams need a different patching conversation​

Solid Edge is Windows-based engineering software used across mechanical design, drafting, sheet-metal work, simulation, manufacturing, and data-management workflows. In such environments, patching is often slowed by valid concerns: add-in compatibility, license-server dependencies, document conversion behavior, validation requirements, and the need to avoid disrupting active production jobs.

Those constraints justify testing; they do not justify leaving ordinary design files as a code-execution route indefinitely. The more defensible approach is a short, documented validation window with heightened controls over incoming native documents, followed by deployment to the engineering fleet. If a critical workflow cannot move to the fixed build, that exception should be explicit, time-limited, and paired with restrictions on opening externally supplied Solid Edge files.

The calendar is also worth noting. Siemens published its advisory on August 11, and CISA republished it on August 13. That leaves little reason to wait for another monthly Windows servicing cycle or a broader industrial patch bundle: the remediation is a Siemens Solid Edge update, and the affected users are the people opening CAD documents today.