What is the CVSS score of CVE-2026-23715?

CVE-2026-23715 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Simcenter Femap are affected by CVE-2026-23715?

Simcenter Femap and Nastran users are exposed to a high-severity vulnerability affecting all versions below V2512 that could allow attackers to execute code or crash applications through malicious…

How to fix or mitigate CVE-2026-23715?

Within 24 hours: Identify all systems running Simcenter Femap and Nastran versions below V2512 and restrict file sharing/import capabilities where feasible. Within 7 days: Implement network segmentation to isolate affected systems, disable XDB file parsing if not critical to operations, and establish user awareness training on suspicious file handling. Within 30 days: Monitor Siemens security advisories for patch availability, conduct vendor risk assessment, and plan upgrade to V2512 or later immediately upon release.

Simcenter Femap CVE-2026-23715

HIGH

Out-of-bounds Write (CWE-787)

2026-02-10 productcert@siemens.com

Buffer Overflow Simcenter Femap Simcenter Nastran

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 10:15 nvd

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Arbitrary code execution in Simcenter Femap and Nastran versions prior to V2512 results from an out-of-bounds write flaw triggered by parsing malicious XDB files. Local attackers with user interaction can exploit this vulnerability to execute arbitrary code with the privileges of the affected application. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious XDB file

Delivery

User opens file in Femap/Nastran

Exploit

Parser reads out-of-bounds memory

Execution

Write arbitrary data to heap

Impact

Execute code as current user

Access

Craft malicious XDB file

Delivery

User opens file in Femap/Nastran

Exploit

Parser reads out-of-bounds memory

Execution

Write arbitrary data to heap

Impact

Execute code as current user

Vulnerability AssessmentAI

Exploitation	User must open a malicious XDB file in Simcenter Femap or Simcenter Nastran versions before V2512. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.8 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to execute code in the context of the current process.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running Simcenter Femap and Nastran versions below V2512 and restrict file sharing/import capabilities where feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.