High severity · published Aug 11, 2026
CVE-2026-59086
A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606)
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Simcenter Femap · Siemens
before V2606 · source: vendor
SN
Simcenter Nastran · Siemens
before V2606 · source: vendor
In the news
VulnerabilityHigh
Siemens Simcenter Nastran
View CSAF
Summary
Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released new versions for the affected products and recommends to update to the latest versions.
The following versions of Siemens Simcenter Nastran are affected:
Simcenter Femap vers:intdot/<2606 (CVE-2026-59086)
Simcenter Nastran vers:intdot/<2606 (CVE-2026-59086)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.8
Siemens
Siemens Simcenter Nastran
Stack-based Buffer Overflow
Background
Critical Infrastructure Sectors: Critical Manufacturing, Defense Industrial Base, Energy, Healthcare and Public Health, Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2026-59086
The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
View CVE Details
Affected Products
Siemens Simcenter Nastran
Vendor: Siemens
Product Version: Simcenter ...
Aug 18, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59086
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-069220.html
More from Simcenter Femap
8.8
CVE-2022-28661
A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.2)
8.1
CVE-2025-40801
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412…
7.8
CVE-2026-59701
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001)
7.8
CVE-2026-59700
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001)
7.8
CVE-2025-12659
Heap-based buffer overflow in Siemens Simcenter Femap
