Quick answers
- Is CVE-2026-50060 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50060 being exploited in the wild.
- How severe is CVE-2026-50060?
- High severity, with a CVSS score of 7.8, published 11 August 2026.
- Which products and versions are affected?
- Siemens Solid Edge SE2026 All versions < V226.0 Update 7; Siemens Solid Edge Se2025 All versions < V225.0 Update 15.
- Is there a fix for CVE-2026-50060?
- A patch was published on 2026-08-11: Patches released: SE2025 Update 15 and SE2026 Update 7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-50060 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-50060?
- Check whether you run Siemens Solid Edge SE2026 or Siemens Solid Edge Se2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability (CVE-2026-50060) is a use-after-free flaw in Solid Edge's DFT file parser triggered when parsing specially crafted files. The attack requires user interaction (opening a malicious file) but requires no privileges or authentication. An attacker can achieve arbitrary code execution in the context of the Solid Edge process. Siemens has released patches: Solid Edge SE2025 Update 15 and SE2026 Update 7 address this and related file parsing vulnerabilities (CVE-2026-50058 through CVE-2026-50064 affecting DFT, PAR, and PSM file formats).
Affected products
- Siemens Solid Edge SE2025 All versions < V225.0 Update 15
- Siemens Solid Edge SE2026 All versions < V226.0 Update 7
Timeline
- 2026-08-11: disclosed: Public disclosure via Siemens ProductCERT advisory SSA-621657
- 2026-08-11: patched: Patches released: SE2025 Update 15 and SE2026 Update 7