CVE-2026-23718 Siemens CVE debrief

Who should care

Organizations using Siemens Simcenter Femap or Simcenter Nastran, especially engineers and administrators who routinely open external or untrusted model files. ICS/OT teams and endpoint defenders should care because the issue is user-triggered and may lead to code execution in the application process.

Technical summary

The vendor advisory describes an out-of-bounds read while parsing specially crafted NDB files. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a local, user-interaction-dependent attack path with high potential impact. The source remediation guidance recommends updating affected products to V2512 or later. The advisory text also includes a mitigation to avoid opening untrusted XDB files; because the vulnerability description refers to NDB files, that file-extension wording should be treated carefully and read alongside the vendor advisory.

Defensive priority

High. The issue is not listed as a CISA KEV vulnerability in the supplied data, but it has a 7.8 CVSS score and can result in code execution if a user opens a malicious file in an affected application.

Recommended defensive actions

• Update Siemens Simcenter Femap to V2512 or later.
• Update Siemens Simcenter Nastran to V2512 or later.
• Do not open untrusted model files in affected applications.
• Review workflows that import files from external partners, contractors, or download sources.
• Apply defense-in-depth controls for engineering workstations, including least privilege and application/network isolation where appropriate.
• Monitor for unexpected crashes or anomalous behavior when parsing NDB/XDB files in affected environments.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-048-01, which cites Siemens ProductCERT SSA-965753. The source lists Siemens as vendor and Simcenter Femap plus Simcenter Nastran as affected products. The published date is 2026-02-10 and the source was republished on 2026-02-17. The advisory states that parsing specially crafted NDB files can cause an out-of-bounds read and potential code execution in the current process. The remediation section recommends V2512 or later and includes a file-handling mitigation. No KEV date or ransomware campaign use is present in the supplied data.

Official resources