CISA has published ICS advisory ICSA-26-225-10 covering an out-of-bounds read vulnerability in Siemens Parasolid, the geometric modeling kernel that sits underneath a massive share of the commercial CAD/CAM/CAE ecosystem. Tracked as CVE-2026-64629 with a CVSS v3 score of 7.8, the flaw is triggered when a Parasolid-based application parses a crafted X_T (Parasolid transmit) file. Successful exploitation can crash the host application or — the outcome that should get your attention — allow arbitrary code execution in the context of the user who opened the file.
This matters well beyond shops running Siemens PLM software directly. Parasolid is licensed and embedded into hundreds of third-party engineering applications: SolidWorks, Onshape, Ansys, Mastercam, and a long tail of niche CAM and metrology tools all parse X_T data through this kernel. If your organization designs, manufactures, or reviews anything in 3D — and CISA flags this under the Critical Manufacturing sector with worldwide deployment — you almost certainly have Parasolid code in your environment whether the word "Siemens" appears in your asset inventory or not.
The attack scenario is depressingly familiar to anyone who has worked engineering-sector intrusions: a weaponized X_T file is delivered via phishing email, a compromised supplier exchange portal, or a poisoned file-share between contractors. An engineer opens it in their CAD tool — a completely routine, expected action — and the parser trips the out-of-bounds read. At minimum you've lost the session; at worst, the attacker now has code execution on an engineering workstation, which typically holds CAD vault credentials, PLM session tokens, network drive mappings to design repositories, and often flat network access to OT-adjacent segments. Engineering workstations are high-value targets precisely because they are trusted, powerful, and historically under-monitored.
Technical Analysis
Affected Products and Versions
Per the advisory, the following Parasolid versions are affected by CVE-2026-64629:
- Parasolid V38.0 — all versions prior to 38.0.235
- Parasolid V38.1 — all versions prior to 38.1.230
The vulnerability class is CWE-125: Out-of-bounds Read, and the affected component is the X_T format parser. X_T (along with its binary sibling X_B) is Parasolid's native model exchange format, used pervasively for moving geometry between CAD systems, suppliers, and downstream manufacturing tools.
How the Vulnerability Works — Defender's View
File-parsing vulnerabilities in CAD kernels follow a consistent exploitation pattern:
- Delivery: The attacker delivers a crafted
.x_tfile. Realistic vectors include spear-phishing attachments (frequently zipped to evade gateways), malicious files planted on supplier portals or shared engineering drives, watering-hole distribution on forums where engineers exchange models, or insertion into a compromised PLM/vault synchronization flow. - Trigger: A user opens or imports the file in any application linked against a vulnerable Parasolid build. No macros, no user prompts beyond opening the file — parsing happens automatically. Some viewers and PLM thumbnail/preview generators may even parse the file without explicit user action.
- Exploitation: The malformed X_T content causes the parser to read beyond the bounds of an allocated buffer. Out-of-bounds reads in complex parsers are frequently chainable: a carefully engineered read can leak memory layout information (defeating ASLR) or corrupt adjacent structures, and in practice these bugs are routinely escalated to full code execution — which is exactly why Siemens' advisory states arbitrary code execution is possible.
- Post-exploitation: Code executes with the privileges of the user running the CAD application. Expect follow-on behavior typical of engineering-sector intrusions: credential theft from CAD vault clients, staging of design data for exfiltration, or pivoting toward OT/shop-floor systems.
CVSS and Severity
- CVSS v3: 7.8 (High) — consistent with a local/ user-interaction-required code execution flaw (typical vector: AV:L/AC:L/PR:N/UI:R).
The UI:R (user interaction required) component is the only thing keeping this out of critical territory, and in practice it's a weak mitigating factor — opening CAD files is the job description for the target population. Engineers cannot simply "stop opening files from suppliers."
Exploitation Status
As of this writing, CISA has not reported known public proof-of-concept code or confirmed in-the-wild exploitation, and CVE-2026-64629 is not listed in the CISA Known Exploited Vulnerabilities catalog. That should not breed complacency: ICS/CAD parser advisories have a long history of quiet exploitation in targeted espionage campaigns against manufacturers, and the gap between advisory publication and opportunistic weaponization is typically measured in weeks once researchers diff the patched parser.
Detection & Response
Detection for a file-parsing flaw focuses on three observable behaviors: (1) delivery of X_T files through high-risk channels, (2) crashes of CAD applications consistent with parser exploitation, and (3) post-exploitation child process activity originating from CAD processes — the highest-fidelity signal, because CAD kernels essentially never legitimately spawn shells, scripting engines, or Office-style child processes.
Sigma Rules
The following rules target the behaviors above. Tune the CAD process list to your environment's actual application inventory (SolidWorks SLDWORKS.exe, NX ugraf.exe, Solid Edge Edge.exe, Mastercam mastercam.exe, Onshape/Ansys components, etc.).
---
title: CAD Application Spawning Suspicious Child Process (Potential Parasolid Exploit Follow-On)
id: 3f8c2a71-9b4e-4d6a-b1f5-7e2a9c4d8f01
status: experimental
description: Detects CAD/CAE applications spawning shells, script interpreters, or LOLBins. Parasolid-based CAD processes virtually never spawn these children legitimately; this is a high-fidelity indicator of successful file-parser exploitation such as CVE-2026-64629.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10
- https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/02/11
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\SLDWORKS.exe'
- '\ugraf.exe'
- '\Edge.exe'
- '\mastercam.exe'
- '\siemensnx.exe'
- '\ansys.exe'
- '\ansyswb.exe'
- '\seviewer.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wmic.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\msbuild.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare CAD plugin installers or automation macros; investigate any hit rather than tuning it away
level: high
---
title: Suspicious X_T or X_B Parasolid File Written from Browser or Email Client
id: 8a1e5d42-6c7b-4f39-a2e8-5d1b7f3c9e04
status: experimental
description: Detects Parasolid transmit files (.x_t / .x_b) written to disk by browsers or email clients, indicating delivery via phishing or watering-hole download. Correlate with subsequent CAD process crashes or child-process alerts on the same host.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10
- https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/02/11
tags:
- attack.initial_access
- attack.t1566.001
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\OUTLOOK.EXE'
- '\thunderbird.exe'
selection_target:
TargetFilename|endswith:
- '.x_t'
- '.x_b'
condition: selection_image and selection_target
falsepositives:
- Legitimate engineering file downloads from supplier portals; baseline against known-good source domains
level: medium
---
title: CAD Application Crash After Opening Parasolid File
id: 5b7d3f19-2e8a-4c41-b6d3-9f4a1e8c7d02
status: experimental
description: Detects Windows Error Reporting crash events for known CAD applications, a possible indicator of X_T parser exploitation attempts (CVE-2026-64629). Repeated crashes on the same host, or crashes correlating with recent .x_t file writes, warrant immediate triage.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-10
author: Security Arsenal
date: 2026/02/11
tags:
- attack.exploitation_for_client_execution
- attack.t1203
logsource:
product: windows
service: application
detection:
selection_source:
Provider_Name:
- 'Application Error'
- 'Windows Error Reporting'
selection_message:
Message|contains:
- 'SLDWORKS.exe'
- 'ugraf.exe'
- 'Edge.exe'
- 'mastercam.exe'
- 'pskernel.dll'
- 'parasolid'
condition: selection_source and selection_message
falsepositives:
- Routine CAD instability; single crashes are common in engineering environments — alert on clustering and correlation with file-write events
level: medium
Microsoft Sentinel / Defender KQL
This hunt correlates X_T file delivery (Mark-of-the-Web files from the internet zone) with subsequent crashes or suspicious child processes from CAD applications on the same device. Run it across a 14-day window and treat any joined result as an incident, not a detection anomaly.
// Hunt: X_T/X_B delivery via internet followed by CAD crashes or suspicious child processes
let TimeWindow = 14d;
let CADDelivery =
DeviceFileEvents
| where TimeGenerated > ago(TimeWindow)
| where FileName endswith ".x_t" or FileName endswith ".x_b"
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","outlook.exe","thunderbird.exe")
or FolderPath has "Downloads" or FolderPath has "Temp"
| summarize FirstDelivery=min(TimeGenerated), FileCount=count(), Files=make_set(FileName, 10)
by DeviceName, SHA256
| extend DeliveryBucket = bin(FirstDelivery, 1d);
let CADAnomalies =
DeviceProcessEvents
| where TimeGenerated > ago(TimeWindow)
| where InitiatingProcessFileName in~ ("sldworks.exe","ugraf.exe","edge.exe","mastercam.exe","ansys.exe","ansyswb.exe","seviewer.exe")
and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","certutil.exe","bitsadmin.exe")
| summarize AnomalousChildren=count(), Commands=make_set(ProcessCommandLine, 10), FirstExec=min(TimeGenerated)
by DeviceName, InitiatingProcessFileName
| extend AnomalyBucket = bin(FirstExec, 1d);
CADAnomalies
| join kind=inner CADDelivery on DeviceName
| where FirstExec between (FirstDelivery .. FirstDelivery + 1d)
| project DeviceName, FirstDelivery, Files, SHA256, InitiatingProcessFileName, Commands, FirstExec
| order by FirstDelivery desc;
If you ingest Sysmon or Windows Error Reporting via SecurityEvent, this companion query surfaces CAD crash clusters per host — a useful triage view even without the file-delivery join:
// CAD crash cluster triage via Windows Error Reporting (requires WER/Application Error ingestion)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventSourceName in ("Application Error", "Windows Error Reporting")
| where EventData has_any ("SLDWORKS.exe", "ugraf.exe", "Edge.exe", "mastercam.exe", "pskernel.dll", "parasolid")
| summarize CrashCount=count(), FirstCrash=min(TimeGenerated), LastCrash=max(TimeGenerated) by Computer
| where CrashCount >= 2
| order by CrashCount desc;
Velociraptor VQL
For endpoint triage on a suspect engineering workstation, this artifact enumerates recently created X_T/X_B files along with their Zone.Identifier alternate data stream (Mark-of-the-Web evidence) and running CAD processes, giving you both the delivery artifact and the exploitation target in one collection.
-- Artifact: Hunt for recently delivered Parasolid X_T/X_B files with Mark-of-the-Web
-- and enumerate running CAD processes on the endpoint
LET cad_files = SELECT FullPath AS FilePath, Mtime AS Modified, Size AS FileSize,
read_file(filename=FullPath + ':Zone.Identifier', length=512) AS MOTW
FROM glob(globs=['C:/Users/*/Downloads/*.x_t', 'C:/Users/*/Downloads/*.x_b',
'C:/Users/*/Desktop/*.x_t', 'C:/Users/*/Desktop/*.x_b',
'C:/Users/*/Documents/*.x_t', 'C:/Users/*/Documents/*.x_b',
'C:/Temp/*.x_t', 'C:/Temp/*.x_b'])
WHERE Modified > (now() - 1209600)
LET cad_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)sldworks|ugraf|mastercam|ansys|seviewer'
OR Exe =~ '(?i)parasolid|pskernel'
SELECT * FROM cad_files
UNION ALL
SELECT Pid AS FilePath, Name AS Modified, Exe AS FileSize,
CommandLine AS MOTW FROM cad_procs
Remediation
Immediate Actions
- Patch Parasolid to a fixed version. Siemens has released updates; upgrade to V38.0.235 or later (for the V38.0 branch) or V38.1.230 or later (for the V38.1 branch). The official Siemens advisory is linked from the CISA advisory: ICSA-26-225-10.
- Inventory the blast radius — including third-party applications. This is the step most organizations miss. Parasolid ships inside products from dozens of vendors. Pull your software inventory for anything with CAD/CAE/CAM function and check with those vendors whether they embed affected Parasolid builds and when their updated releases ship. Do not assume your Siemens tools are your only exposure.
- Identify vulnerable DLLs on endpoints. The verification script below scans for Parasolid kernel libraries and reports file versions, giving you an environment-wide exposure readout.
Verification and Inventory Script
# Parasolid Exposure Inventory — run via SCCM/Intune/GPO or EDR live response
# Scans common install locations for Parasolid kernel components and reports versions
$SearchRoots = @(
"$env:ProgramFiles",
"${env:ProgramFiles(x86)}",
"$env:ProgramData\Siemens"
)
$ParasolidModules = @('pskernel.dll','psbodyshop.dll','parasolid*.dll','x_t*.dll')
$results = @()
foreach ($root in $SearchRoots) {
if (Test-Path $root) {
foreach ($mod in $ParasolidModules) {
$found = Get-ChildItem -Path $root -Filter $mod -Recurse -ErrorAction SilentlyContinue
foreach ($f in $found) {
$v = $f.VersionInfo
$results += [PSCustomObject]@{
Computer = $env:COMPUTERNAME
Path = $f.FullName
ProductVersion = $v.ProductVersion
FileVersion = $v.FileVersion
ProductName = $v.ProductName
Vulnerable = $null
}
}
}
}
}
# Flag vulnerable builds: V38.0 below 38.0.235, V38.1 below 38.1.230
foreach ($r in $results) {
if ($r.ProductVersion -match '^(\d+)\.(\d+)\.(\d+)') {
$major = [int]$Matches[1]; $minor = [int]$Matches[2]; $build = [int]$Matches[3]
if ($major -eq 38 -and $minor -eq 0 -and $build -lt 235) { $r.Vulnerable = $true }
elseif ($major -eq 38 -and $minor -eq 1 -and $build -lt 230) { $r.Vulnerable = $true }
elseif ($major -eq 38 -and $minor -eq 0 -and $build -ge 235) { $r.Vulnerable = $false }
elseif ($major -eq 38 -and $minor -eq 1 -and $build -ge 230) { $r.Vulnerable = $false }
}
}
$results | Format-Table -AutoSize
$results | Export-Csv -Path ".\parasolid_inventory_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
# Also enumerate installed Siemens/Parasolid-based applications for the vendor follow-up list
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -match 'Parasolid|Siemens|Solid Edge|NX|SolidWorks|Mastercam|Ansys' } |
Select-Object DisplayName, DisplayVersion, Publisher |
Sort-Object DisplayName
Compensating Controls While Patching
If patch deployment across your engineering fleet will take time (and with CAD environments and their validation cycles, it usually does), layer these controls:
- Email gateway and download filtering: Treat inbound
.x_t/.x_battachments from external senders as high-risk. Detonate them in sandboxing where supported, or quarantine and require an explicit release workflow for supplier files. - Mark-of-the-Web enforcement: Ensure MOTW is preserved on downloaded engineering files and consider SmartScreen/attack surface reduction rules that warn on execution-context content from the internet zone.
- Disable preview/thumbnail parsing where feasible: PLM thumbnail generators and Windows Explorer preview handlers that parse X_T without user interaction raise the exploitation surface significantly.
- Application control on engineering workstations: AppLocker/WDAC policies preventing CAD applications from launching child processes (as codified in the Sigma rule above) provide genuine exploit-chain breakage even pre-patch.
- Segment engineering from OT: Any workstation that opens supplier-supplied CAD files should be treated as internet-exposed. Enforce firewall boundaries between engineering VLANs and shop-floor/OT segments, and monitor east-west traffic from CAD subnets.
- Supplier file hygiene: Establish a policy that externally sourced models are opened first in an isolated validation environment (a hardened VM with no vault credentials and no domain trust) before reaching production engineering workstations.
Longer-Term Hardening
Engineering file-parsing flaws are a persistent intrusion vector against manufacturers, and CVE-2026-64629 will not be the last Parasolid advisory. Fold CAD/PLM infrastructure into your vulnerability management program explicitly: inventory embedded kernel versions, subscribe to CISA ICS advisories, and include engineering workstations in threat-hunting scope rather than treating them as exotic endpoints that the SOC politely ignores.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.