Siemens Simcenter Nastran and Femap Stack-Based Buffer Overflow Vulnerability (CVE-2026-59086)

Siemens ProductCERT has issued a security advisory (SSA-069220) regarding a stack-based buffer overflow vulnerability affecting Simcenter Nastran and Simcenter Femap. The vulnerability, tracked as CVE-2026-59086, occurs when an application binary reads an arbitrary string as a file argument. If a user is tricked into running one of the impacted application binaries with a malicious string, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process.

The affected product versions include Simcenter Femap prior to V2606 and Simcenter Nastran prior to V2606. Siemens has released new versions for the affected products and recommends updating to the latest versions to mitigate the risk.

The CVSS v3.1 vector string is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a base score of 7.8 (HIGH). The vulnerability requires user interaction (tricking a user into running a malicious binary) and local or adjacent access. While the vulnerability could allow an attacker to execute arbitrary code in the context of the current process, leading to potential full system compromise, no public exploit code has been confirmed at the time of reporting.

CISA has republication of the advisory as ICSA-26-230-02, recommending that users minimize network exposure for control system devices, ensure they are not accessible from the internet, and locate control system networks behind firewalls. CISA also recommends implementing VPNs for remote access when required and performing proper impact analysis and risk assessment prior to deploying defensive measures.

Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' operational guidelines for Industrial Security. Additional information is available at https://support.sw.siemens.com/product/275652363/.