CVE-2026-59700 & CVE-2026-59701: Siemens Simcenter Femap BMP Parsing Flaws — Detection and Remediation Guide

---
title: Siemens Simcenter Femap Spawning Child Process
description: Detects the Femap application spawning a child process, which may indicate successful exploitation of CVE-2026-59700 or CVE-2026-59701 via a malicious BMP file. Femap does not legitimately spawn shells, script interpreters, or Office applications.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-11
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/13
status: experimental
id: 8f2a1c44-3d7b-4e91-b6a2-5c9d0e1f2a3b
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\femap.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Femap may invoke licensed solver binaries, which should be excluded by path once observed
level: high
---
title: BMP File Written to Engineering Workstation Temp or Email Cache
description: Detects BMP image files being written to temporary, email cache, or download directories on systems where Femap is installed, a common delivery staging pattern for CVE-2026-59700/CVE-2026-59701 malicious file attacks. Tune to your environment's file-delivery paths.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-11
  - https://attack.mitre.org/techniques/T1566.001/
author: Security Arsenal
date: 2026/08/13
status: experimental
id: 2b7e9d15-6a4c-4f38-9d01-8e3b5c7a9f24
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith: '.bmp'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - 'Content.Outlook\'
      - '\INetCache\'
  filter_known_apps:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
  condition: selection_ext and selection_path and not filter_known_apps
falsepositives:
  - Screenshot tools and legacy document workflows that export BMP files; exclude known exporter binaries
level: medium
---
title: Siemens Femap Application Crash Followed by Suspicious Execution
description: Detects a Femap crash event followed by execution of a command shell or script interpreter on the same host within a short window, consistent with exploitation of CVE-2026-59700/CVE-2026-59701 where an attacker payload stabilizes after a parsing crash.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-11
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/13
status: experimental
id: 4c6d8f02-1b3a-4e59-a7c4-9d2e6f8a0b15
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WerFault.exe'
      - '\werfaultsecure.exe'
    CommandLine|contains:
      - 'femap.exe'
  condition: selection
falsepositives:
  - Genuine Femap instability from oversized models; investigate any crash co-occurring with new BMP files on the host
level: medium

// Hunt 1: Femap spawning suspicious child processes (post-exploitation behavior)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "femap.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
    "bitsadmin.exe", "wmic.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessCommandLine, InitiatingProcessFolderPath, ReportId
| order by TimeGenerated desc

// Hunt 2: BMP files staged in delivery directories, correlated with Femap on the same host
let BmpHosts =
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where FileName endswith ".bmp"
    | where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "Content.Outlook", "INetCache")
    | summarize BmpCount = count(), BmpFiles = make_set(FileName, 20),
        FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessFileName;
BmpHosts
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "femap.exe"
    | summarize FemapRuns = count() by DeviceName
) on DeviceName
| project DeviceName, BmpCount, BmpFiles, InitiatingProcessFileName,
    FemapRuns, FirstSeen, LastSeen
| order by BmpCount desc

// Hunt 3: Femap application crashes (WerFault) as potential exploitation attempts
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "WerFault.exe"
| where ProcessCommandLine has "femap"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine,
    InitiatingProcessFileName
| order by TimeGenerated desc

-- Security Arsenal: Hunt for vulnerable Femap installs, suspicious child processes,
-- and staged BMP files (CVE-2026-59700 / CVE-2026-59701)

-- 1. Identify installed Femap versions from uninstall registry keys
SELECT DisplayName, DisplayVersion, InstallLocation, Key.Name AS RegKey
FROM glob(
  globs='HKLM:/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/*/DisplayName',
  accessor='registry'
)
WHERE DisplayName =~ 'Femap'

-- 2. Femap processes with unexpected children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)femap\\.exe'
   OR CommandLine =~ '(?i)femap'

-- 3. BMP files recently written to staging directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(
  globs=[
    'C:/Users/*/Downloads/*.bmp',
    'C:/Users/*/AppData/Local/Temp/*.bmp'
  ]
)
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC

# Security Arsenal - Siemens Simcenter Femap CVE-2026-59700/59701 verification script
# Run elevated on engineering workstations

$fixedVersion = [version]"2606.0001"
$report = [ordered]@{ Host = $env:COMPUTERNAME; Installs = @(); Crashes = @(); Verdict = "UNKNOWN" }

# 1. Locate Femap installations via uninstall registry
$uninstallPaths = @(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
$femapInstalls = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match "Femap" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

foreach ($inst in $femapInstalls) {
  $v = $null
  [void][version]::TryParse(($inst.DisplayVersion -replace '[^0-9\.]', ''), [ref]$v)
  $status = if ($v -and $v -lt $fixedVersion) { "VULNERABLE" } elseif ($v) { "PATCHED" } else { "VERSION-UNPARSED" }
  $report.Installs += [pscustomobject]@{
    Product = $inst.DisplayName
    Version = $inst.DisplayVersion
    Path    = $inst.InstallLocation
    Status  = $status
  }
}

# 2. Check Application event log for Femap crashes in the last 30 days
$crashes = Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 1000; StartTime = (Get-Date).AddDays(-30) } -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "femap" } |
  Select-Object TimeCreated, Message
$report.Crashes = $crashes

# 3. Verdict
if (-not $femapInstalls) { $report.Verdict = "FEMAP-NOT-INSTALLED" }
elseif ($report.Installs.Status -contains "VULNERABLE") { $report.Verdict = "ACTION-REQUIRED: Update to Simcenter Femap 2606.0001 or later" }
elseif ($report.Installs.Status -contains "VERSION-UNPARSED") { $report.Verdict = "MANUAL-REVIEW: Could not parse installed version" }
else { $report.Verdict = "COMPLIANT" }

$report.Installs | Format-Table -AutoSize
Write-Host "`nVerdict: $($report.Verdict)" -ForegroundColor (if ($report.Verdict -match "ACTION") { "Red" } else { "Green" })
if ($report.Crashes) {
  Write-Host "`nFemap crash events (last 30 days) - review for exploitation attempts:" -ForegroundColor Yellow
  $report.Crashes | Format-Table TimeCreated -AutoSize
}