As reported by CISA in advisory ICSA-26-225-12, Siemens has披露 seven high-severity file-parsing vulnerabilities in Solid Edge that could allow an attacker to crash the application or achieve arbitrary code execution by tricking a user into opening a maliciously crafted PAR, PSM, or DFT file. All seven CVEs carry a CVSS 3.1 base score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — meaning the attacker needs no privileges, only user interaction.
Why This Matters for OT and Engineering Environments
Solid Edge is widely deployed across critical manufacturing sectors worldwide. While these are local-context vulnerabilities requiring a user to open a malicious file, the realistic attack surface in engineering environments is far broader than it appears. CAD files flow constantly through supply chains — shared via email, PLM systems, vendor portals, and partner exchanges. A single compromised supplier or a targeted spear-phishing campaign could introduce a tainted DFT file into a design workflow, leading to code execution on an engineer's workstation with domain credentials and access to sensitive intellectual property.
The supply-chain vector for CAD files is chronically underappreciated. Engineering teams routinely open files from external partners with minimal scrutiny, making file-format vulnerabilities a quiet but potent initial-access path.
Vulnerability Summary
| CVE | Type | File Format | CVSS |
|---|---|---|---|
| CVE-2026-50058 | Out-of-bounds Read | DFT | 7.8 High |
| CVE-2026-50059 | Out-of-bounds Write | DFT | 7.8 High |
| CVE-2026-50060 | Out-of-bounds Read | PAR | 7.8 High |
| CVE-2026-50061 | Out-of-bounds Write | PAR | 7.8 High |
| CVE-2026-50062 | Use After Free | PSM | 7.8 High |
| CVE-2026-50063 | Out-of-bounds Read | PSM | 7.8 High |
| CVE-2026-50064 | Out-of-bounds Write | DFT | 7.8 High |
Affected Products and Patch Status
- Solid Edge SE2025 — versions prior to V225.0 Update 15: patch to V225.0 Update 15 or later
- Solid Edge SE2026 — versions prior to V226.0 Update 7: patch to V226.0 Update 7 or later
No evidence of active exploitation in the wild has been reported as of the advisory's August 13, 2026 release date. However, the public disclosure of vulnerability details and the availability of patch information create a window where threat actors may reverse-engineer exploit paths.
Who Is Most at Risk
Manufacturing organizations — particularly those in critical infrastructure sectors — face the highest exposure. Discrete manufacturers, automotive suppliers, aerospace contractors, and industrial equipment designers that exchange CAD files with external partners are especially vulnerable. Environments where Solid Edge runs on workstations connected to production networks or where engineers hold elevated domain credentials amplify the blast radius of a successful exploitation.
Shield53 Recommendations
Immediate Actions
Edge.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe — strong indicators of exploitation.Longer-Term Hardening
- Inventory all Solid Edge installations across the enterprise and establish a software inventory baseline for engineering tools.
- Implement least-privilege for engineering accounts — avoid domain admin or local admin rights on CAD workstations where feasible.
- Engage with key suppliers to verify their own patch posture and establish CAD-file security expectations in vendor agreements.
