Siemens Solid Edge CVE-2026-50058 to CVE-2026-50064: File Parsing RCE Detection and Remediation Guide

CISA has published ICS advisory ICSA-26-225-12 covering seven distinct file parsing vulnerabilities in Siemens Solid Edge, the CAD platform used across manufacturing, defense, automotive, and industrial design environments. The flaws — CVE-2026-50058 through CVE-2026-50064 — are triggered when Solid Edge parses a specially crafted PAR (part), PSM (sheet metal), or DFT (draft) file. Successful exploitation gives an attacker either a denial of service via application crash or, far worse, arbitrary code execution in the context of the engineer who opened the file.

Every CVE in this set carries a CVSS v3 score of 7.8 (High). That score reflects a realistic attack model: file parsing bugs in CAD software are among the most reliably weaponized vulnerability classes in industrial espionage, because engineering workstations are high-value targets and opening a supplier-provided CAD file is a routine, trusted action. Siemens has released fixed builds and is urging immediate updates. If your organization runs Solid Edge SE2025 builds earlier than 225.0.15, or SE2026 builds earlier than 226.0.7, treat this as a priority remediation.

Technical Analysis

Affected Products and Versions

Per the CISA advisory and the accompanying Siemens CSAF document:

• Solid Edge SE2025 — all versions prior to 225.0.15 (affected by CVE-2026-50058, CVE-2026-50059, CVE-2026-50060, CVE-2026-50061, CVE-2026-50062, CVE-2026-50063, CVE-2026-50064)
• Solid Edge SE2026 — all versions prior to 226.0.7 (affected by the same seven CVEs)

Vulnerability Mechanics

All seven CVEs are file parsing vulnerabilities in the code paths Solid Edge uses to ingest its native document formats:

• PAR — 3D part/assembly geometry files
• PSM — sheet metal part files
• DFT — 2D draft/drawing files

The exploitation chain is classic for this vulnerability class:

1. Delivery: The attacker delivers a maliciously crafted PAR, PSM, or DFT file. Typical vectors in engineering environments include spear-phishing attachments, compromised supplier portals, shared PLM/PDM repositories, or watering-hole downloads of component libraries. CAD files are rarely blocked by email gateways and are implicitly trusted by engineers.
2. Trigger: The victim opens or even previews the file in Solid Edge. No macros, no enable-content prompts — parsing happens automatically.
3. Memory corruption: The crafted file structure hits the vulnerable parser routine, corrupting memory during deserialization of the malformed geometry or drawing data.
4. Impact: At minimum, the Solid Edge process (Edge.exe) crashes. With proper heap grooming, the attacker achieves arbitrary code execution under the engineer's user context — which in most engineering domains means access to sensitive IP, network file shares, PLM credentials, and often lateral movement paths into OT-adjacent segments.

Seven separate CVEs across the same three file formats strongly suggests a coordinated fuzzing effort against Solid Edge's parsing engine — which in turn tells defenders that the parser attack surface is broad and that residual, unpatched variants of these bugs likely remain discoverable. Patching promptly matters more here than usual.

Exploitation Status

As of the advisory publication, there is no confirmed in-the-wild exploitation and none of the seven CVEs appear in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been observed. However, exploitation of this bug class requires only local file delivery and user interaction — the barrier to weaponization is low, and industrial design files are a documented delivery vector in espionage campaigns targeting manufacturing and defense contractors. Treat the window between disclosure and patch as your highest-risk period.

Detection & Response

Because exploitation requires a user to open a malicious CAD file, detection strategy focuses on three observables: (1) anomalous child process activity from the Solid Edge process, (2) CAD files appearing in suspicious staging locations such as email attachment temp folders, and (3) application crashes of Edge.exe correlating with recently delivered files. Note that the Solid Edge main executable is Edge.exe — be careful not to confuse it with Microsoft Edge (msedge.exe) in your detections; match on full install paths where possible.

Sigma Rules

---
title: Siemens Solid Edge Spawning Suspicious Child Process
id: 3f8a2c41-9b7e-4d15-a602-8e1c5f4d7b9a
status: experimental
description: Detects Solid Edge (Edge.exe) spawning command interpreters, scripting engines, or Office processes, consistent with post-exploitation after a malicious PAR/PSM/DFT file is parsed (CVE-2026-50058 through CVE-2026-50064).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-12
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\Edge.exe'
    ParentImage|contains:
      - 'Solid Edge'
      - 'Program Files\Siemens'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Solid Edge automation or macro integrations may spawn scripts — baseline per engineering team
level: high
---
title: CAD File Written to Suspicious Staging Location
id: 6d2e9b07-4a1f-4c83-b5e9-2f7d8a1c3e64
status: experimental
description: Detects PAR, PSM, or DFT files being created in temporary, download, or email attachment cache directories, a common delivery artifact for weaponized Solid Edge documents (ICSA-26-225-12).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-12
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.par'
      - '.psm'
      - '.dft'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Local\Microsoft\Windows\INetCache\'
      - '\Outlook\'
      - '\Downloads\'
  condition: selection_ext and selection_path
falsepositives:
  - Engineers legitimately downloading CAD files from supplier portals — tune by known-good source process or whitelist managed PLM sync paths
level: medium
---
title: Solid Edge Application Crash via WER
id: 9c4f1d68-7e2b-4a96-c3d1-5b8e6f2a9d17
status: experimental
description: Detects Windows Error Reporting events for Solid Edge (Edge.exe) crashes, which may indicate exploitation attempts against file parsing vulnerabilities (CVE-2026-50058 through CVE-2026-50064) or fuzzing activity.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-12
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.exploitation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WerFault.exe'
      - '\wermgr.exe'
    CommandLine|contains: 'Edge.exe'
  filter_msedge:
    CommandLine|contains: 'msedge.exe'
  condition: selection and not filter_msedge
falsepositives:
  - Legitimate Solid Edge instability; correlate crash frequency per host and with recent file-open events
level: low

KQL — Microsoft Sentinel / Defender

This query hunts for the post-exploitation signature: Solid Edge spawning unusual child processes, and separately surfaces hosts where Edge.exe has recently crashed alongside new CAD files arriving from external sources.

// Hunt 1: Solid Edge spawning suspicious child processes (post-exploitation)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "Edge.exe"
| where InitiatingProcessFolderPath has_any ("Solid Edge", "Siemens")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","certutil.exe","bitsadmin.exe","msbuild.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by TimeGenerated desc;

// Hunt 2: Correlation — Solid Edge crashes and recent CAD file deliveries
let CadFiles = DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where FileName endswith_any (".par",".psm",".dft")
    | where FolderPath has_any ("Temp","INetCache","Outlook","Downloads")
    | summarize CadFileCount=count(), LatestCadFile=max(TimeGenerated) by DeviceName;
DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType has "AppCrash" or AdditionalFields has "WER"
| where FileName =~ "Edge.exe" and FolderPath has "Siemens"
| summarize CrashCount=count(), LastCrash=max(TimeGenerated) by DeviceName
| join kind=inner CadFiles on DeviceName
| project DeviceName, CrashCount, LastCrash, CadFileCount, LatestCadFile
| order by CrashCount desc;

Velociraptor VQL

Use this artifact during IR triage or proactive hunting on engineering workstations to enumerate Solid Edge processes with suspicious children and to inventory recently created CAD files in high-risk staging paths.

-- Solid Edge exploitation triage: anomalous children of Edge.exe and staged CAD files
-- Relevant to ICSA-26-225-12 (CVE-2026-50058 .. CVE-2026-50064)

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM procs
WHERE Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe'
  AND Ppid IN (SELECT Pid FROM procs WHERE Name =~ '^Edge\.exe$' AND Exe =~ 'Siemens|Solid Edge')

LET staged_cad = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/**/*.par',
  'C:/Users/*/AppData/Local/Temp/**/*.psm',
  'C:/Users/*/AppData/Local/Temp/**/*.dft',
  'C:/Users/*/Downloads/**/*.par',
  'C:/Users/*/Downloads/**/*.psm',
  'C:/Users/*/Downloads/**/*.dft',
  'C:/Users/*/AppData/Local/Microsoft/Windows/INetCache/**/*.par',
  'C:/Users/*/AppData/Local/Microsoft/Windows/INetCache/**/*.psm',
  'C:/Users/*/AppData/Local/Microsoft/Windows/INetCache/**/*.dft'
])
WHERE Mtime > now() - 1209600

SELECT 'suspicious_child' AS Finding, format(format='%d %d %s %s', args=[Pid, Ppid, Name, CommandLine]) AS Detail
FROM suspicious_children
UNION ALL
SELECT 'staged_cad_file' AS Finding, FullPath AS Detail
FROM staged_cad

Remediation & Verification Script

Run this PowerShell script (elevated) on engineering workstations to enumerate installed Solid Edge versions, flag vulnerable builds against the fixed version thresholds, and audit recent application crash events for Edge.exe.

# Solid Edge vulnerability verification — ICSA-26-225-12
# Fixed versions: SE2025 >= 225.0.15 | SE2026 >= 226.0.7

$fixedThresholds = @{
    'SE2025' = [version]'225.0.15'
    'SE2026' = [version]'226.0.7'
}

# --- Enumerate installed Solid Edge versions ---
$uninstallKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$installs = Get-ItemProperty $uninstallKeys -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Solid Edge' } |
    Select-Object DisplayName, DisplayVersion, InstallLocation

if (-not $installs) {
    Write-Output "[INFO] No Solid Edge installation detected on $env:COMPUTERNAME."
} else {
    foreach ($app in $installs) {
        $ver = $null
        [void][version]::TryParse(($app.DisplayVersion -replace '[^0-9\.]', ''), [ref]$ver)
        $vulnerable = $false
        if ($app.DisplayName -match '2025' -and $ver -lt $fixedThresholds['SE2025']) { $vulnerable = $true }
        if ($app.DisplayName -match '2026' -and $ver -lt $fixedThresholds['SE2026']) { $vulnerable = $true }
        $status = if ($vulnerable) { 'VULNERABLE - UPDATE REQUIRED' } else { 'Patched / Review' }
        Write-Output "[$status] $($app.DisplayName) v$($app.DisplayVersion) on $env:COMPUTERNAME"
    }
}

# --- Audit recent Edge.exe crash events (potential exploitation attempts) ---
$crashes = Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Id = 1000, 1001 } -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Edge\.exe' -and $_.Message -match 'Solid Edge|Siemens' }

if ($crashes) {
    Write-Output "[ALERT] $($crashes.Count) Solid Edge crash event(s) found in Application log — review for exploitation attempts:"
    $crashes | Select-Object TimeCreated, @{N='Message';E={$_.Message.Substring(0,[Math]::Min(200,$_.Message.Length))}} | Format-List
} else {
    Write-Output "[OK] No Solid Edge crash events detected in recent Application log entries."
}

Remediation

1. Patch Immediately

Siemens has released fixed builds for both affected release trains:

• Solid Edge SE2025: update to version 225.0.15 or later
• Solid Edge SE2026: update to version 226.0.7 or later

Obtain updates through Siemens Support Center / your Siemens PLM Software distribution channel, and validate the installed build number post-update (the script above can be used for fleet-wide verification). In engineering environments where CAD upgrades historically get deferred due to project deadlines, escalate this one: a CVSS 7.8 code-execution bug in a file-open path is exactly the class of vulnerability that adversaries operationalize quickly against manufacturing targets.

2. Apply Compensating Controls While Patching

• Restrict CAD file ingestion: Require that PAR, PSM, and DFT files received from external parties be opened first in a sandboxed or isolated environment (dedicated VM, cloud detonation, or a hardened review workstation) before entering production engineering systems.
• Email and web gateway tuning: Add PAR, PSM, and DFT extensions to attachment inspection/detection policies. These formats routinely bypass content filtering because they are treated as benign binary data.
• Attack Surface Reduction: On Defender-managed endpoints, ensure ASR rules blocking Office child processes and script-based payload delivery are enabled — they provide meaningful post-exploitation friction even though Solid Edge itself is not an Office app.
• Application control: Where feasible, use WDAC/AppLocker to constrain what executables can be launched from user-context processes on engineering workstations.

3. Segment and Monitor Engineering Workstations

CAD workstations hold your crown-jewel intellectual property and often sit adjacent to OT networks. Verify they are not flat-routable to plant floor segments, that outbound internet access is proxied and logged, and that EDR coverage is actually deployed — engineering workstations are chronically under-instrumented because of licensing cost and performance concerns. This advisory is a good forcing function to close that gap.

4. Hunt Retroactively

Run the KQL and VQL hunts above across your fleet for at least the past 90 days. File parsing exploits typically leave few artifacts on success, but failed exploitation attempts (crashes, WER dumps) are noisy. Any Edge.exe crash clustering on a workstation that recently received external CAD files warrants a deeper forensic look — capture memory if the process is still running.

5. Track the Advisory

• CISA advisory: ICSA-26-225-12
• Siemens CSAF: available via the Siemens ProductCERT portal — subscribe to ProductCERT notifications for future Solid Edge advisories
• Monitor CISA KEV for any addition of CVE-2026-50058 through CVE-2026-50064, which would trigger mandatory remediation timelines for federal agencies and should trigger the same urgency for you.

Conclusion

Seven simultaneous file parsing CVEs in Solid Edge's native formats is a clear signal that this parser codebase has been heavily fuzzed — and where researchers found seven, more will follow. The near-term action is straightforward: patch to 225.0.15 / 226.0.7, verify fleet-wide, and put detection around Edge.exe child processes and crash telemetry. The strategic action is harder but more durable: treat engineering workstations and the CAD files flowing into them as the high-value attack surface they demonstrably are, with isolation, inspection, and instrumentation to match.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub