CISA republishes Siemens Solid Edge advisory on seven file-parsing flaws

By Atlas Watchline Staff · Regulatory · August 13, 2026

CISA republished a Siemens ProductCERT advisory warning that file-parsing flaws in Siemens Solid Edge could let an attacker crash the application or run code, with fixes available for two product lines.

CISA on Aug. 13 republished a Siemens ProductCERT advisory about seven vulnerabilities in Siemens Solid Edge that affect how the engineering software parses PAR, PSM and DFT files.

The advisory says specially crafted files could trigger the flaws and allow an attacker to crash the application or execute arbitrary code in the context of the current process. CISA classifies the issues as high severity, with a CVSS v3.1 base score of 7.8.

What happened

The advisory lists seven CVEs: CVE-2026-50058, CVE-2026-50059, CVE-2026-50060, CVE-2026-50061, CVE-2026-50062, CVE-2026-50063 and CVE-2026-50064. CISA’s notice says the issues involve out-of-bounds read, out-of-bounds write and use-after-free conditions while parsing the affected file types.

According to the advisory, the affected versions are Solid Edge SE2025 earlier than V225.0.15 and Solid Edge SE2026 earlier than V226.0.7. Siemens recommends updating to V225.0 Update 15 or later for SE2025 and V226.0 Update 7 or later for SE2026.

Why it matters

Solid Edge is used in industrial and manufacturing settings, and CISA lists the product in the critical manufacturing sector. File-parsing bugs can be triggered before a user can spot anything unusual in the file itself.

The advisory says the affected files are PAR, PSM and DFT. It also says the vulnerabilities may allow code execution in the current process, which can affect the software session handling the file.

Context and background

CISA says Siemens ProductCERT reported the vulnerabilities to CISA. The advisory lists Siemens as the vendor, Siemens Solid Edge as the product, worldwide deployment and Germany as the company headquarters location.

The original publication date in the advisory is Aug. 11, 2026, and CISA’s republication date is Aug. 13, 2026.

What Siemens said

CISA’s republished notice attributes the fix guidance to Siemens. It says users should move to the listed update levels for SE2025 and SE2026.

What happens next

Organizations running affected versions can check whether they are on versions earlier than V225.0.15 or V226.0.7 and apply the relevant update path listed by Siemens.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.