CISA republishes Siemens advisory on BMP parsing flaws in Simcenter Femap

By Atlas Watchline Staff · Regulatory ·

Atlas Watchline newsroom image for: CISA republishes Siemens advisory on BMP parsing flaws in Simcenter Femap

CISA republished a Siemens ProductCERT advisory warning that older versions of Siemens Simcenter Femap contain two BMP parsing flaws that could crash the app or allow code execution.

CISA republished a Siemens ProductCERT advisory on Aug. 13 warning that Siemens Simcenter Femap versions earlier than V2606.0001 contain two BMP file parsing vulnerabilities that could crash the application or potentially allow code execution.

The advisory says the flaws affect software used in critical manufacturing and are rated high severity. CISA said a user who is tricked into opening a malicious BMP file in the affected application could trigger a crash or code execution in the current process.

The advisory identifies the issues as CVE-2026-59700 and CVE-2026-59701. Both are described as out-of-bounds reads while parsing specially crafted BMP files. The advisory says the product is deployed worldwide and lists Siemens’ headquarters in Germany.

CISA said the vulnerabilities carry a CVSS v3.1 base score of 7.8, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The referenced weakness is CWE-125, or out-of-bounds read.

The advisory says Siemens ProductCERT reported the vulnerabilities to CISA. It also says Siemens recommends updating to V2606.0001 or later and links to Siemens support for remediation details.

CISA also repeated general defensive guidance for control systems, including minimizing network exposure, keeping devices off the internet when possible, isolating control system networks from business networks, and using updated VPNs for remote access.

The advisory was initially released on Aug. 11 and republished by CISA on Aug. 13.

Sources

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

View the Web StoryA visual, tap-through version of this report

Share

This is the AMP version of the article. Read the full article on Atlas Watchline.