Which versions of Siemens Solid Edge are affected by CVE-2026-50064?

Organizations running Siemens Solid Edge SE2025 or SE2026 must immediately patch a critical code execution vulnerability in design file handling to prevent intellectual property theft, system…

How to fix or mitigate CVE-2026-50064?

Within 24 hours, identify all Siemens Solid Edge SE2025 and SE2026 deployments in your organization and implement interim controls: restrict users from opening PSM files from untrusted external sources and suspend network sharing of design files from outside your organization until patching is complete. Within 7 days, deploy Siemens Solid Edge SE2025 V225.0 Update 15 or SE2026 V226.0 Update 7 across all affected systems using your standard change management process, starting with the most sensitive design workstations. Within 30 days, confirm 100% patch coverage across all affected deployments, audit access logs for suspicious file operations or execution anomalies during the vulnerability window, and document completion for compliance records.

Siemens Solid Edge CVE-2026-50064

Q: What is the CVSS score of CVE-2026-50064?

CVE-2026-50064 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-56116 HIGH

Out-of-bounds Write (CWE-787)

2026-08-11 siemens

GHSA-qv4h-hhmg-pr37

Buffer Overflow Memory Corruption Siemens Solid Edge Se2025 Solid Edge Se2026

7.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Victim must locally open a crafted file (AV:L, UI:R); high complexity reflects exploit reliability constraints; scope is unchanged and damage is confined to the Solid Edge process (S:U).

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 13:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 11, 2026 - 13:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 13:22 NVD

7.8 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 11, 2026 - 13:14 vuln.today

CVE Published

Aug 11, 2026 - 12:20 cve.org

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.

AnalysisAI

Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

Siemens Solid Edge is a parametric 3D CAD suite used primarily in mechanical engineering and manufacturing workflows. PSM files are Solid Edge part model files central to the application's daily use. The vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption root cause where the parser writes beyond the bounds of an allocated buffer while processing PSM file content - typically caused by insufficient validation of attacker-controlled length or offset fields within the file format. This class of flaw in file parsers can overwrite adjacent memory structures, enabling control-flow hijacking and arbitrary code execution. Confirmed affected CPE identifiers are cpe:2.3:a:siemens:solid_edge_se2025:*:*:*:*:*:*:*:* and cpe:2.3:a:siemens:solid_edge_se2026:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade Solid Edge SE2025 to V225.0 Update 15 or later, and Solid Edge SE2026 to V226.0 Update 7 or later, as directed by Siemens PSIRT advisory SSA-621657 (https://cert-portal.siemens.com/productcert/html/ssa-621657.html). Where immediate patching is not operationally feasible, enforce file-type filtering and sandboxed preview at email gateways to block untrusted PSM files before they reach end-user workstations - note this may disrupt legitimate external collaboration workflows. Disabling automatic file preview in file managers and restricting which users can open externally sourced CAD files via application allow-listing provides an additional compensating control, though it introduces workflow friction for engineers. User awareness training on the risk of unsolicited or unexpected CAD file attachments reduces the social-engineering delivery surface without operational side effects.