Siemens IAM Client Flaw Hits Multiple Industrial Software: Here’s What You Must Fix

Siemens has warned that a local privilege-escalation vulnerability in its IAM Client SDK, tracked as CVE-2025-40945, affects more than ten of its engineering, simulation, and product-lifecycle management applications. The flaw, disclosed on July 14 and amplified by the U.S. Cybersecurity and Infrastructure Security Agency on July 21, requires precise, product-by-product updates — a patch-management headache for the automotive, aerospace, and manufacturing firms that rely on these tools.

The Vulnerability Details

The core issue is an unquoted search path (CWE-426) within the Siemens IAM Client SDK. When a vulnerable application attempts to load a resource — a DLL, executable, or other file — it may search through directories that an attacker can write to. If the attacker places a malicious file with the expected name in such a location, the application loads the attacker’s code with its own high-level privileges. The advisory specifically calls out “unquoted” paths, suggesting improper handling of command lines or file-loading operations where directory names contain spaces.

Siemens rated the vulnerability as Medium severity with a CVSS v3.1 score of 6.7 (vector: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). While “local access” and “high privileges required” temper the score, the impact remains high: full compromise of confidentiality, integrity, and availability. For security teams, the Medium label masks a crucial risk: once an attacker gains any foothold on a workstation — whether through phishing, weak credentials, or a malicious insider — this flaw provides a deterministic path to System-level control. No user interaction is needed, so exploitation can be fully automated after initial access is achieved.

Siemens confirmed the SDK is embedded in the following application lines. The table below lists each product, the vulnerable version range, and the minimum fixed version or update. Beware: some fixes are still in preparation, marked with an asterisk.

*Fixes for Simcenter Nastran, Simcenter STAR-CCM+, and Tecnomatix Process Simulate were still in preparation at advisory publication.

What It Means for You

For Engineers and Designers

If you use Siemens software like Solid Edge, NX, or Simcenter, the immediate task is to check which version you’re running. An annual release name (e.g., “SE2026”) doesn’t guarantee safety — you must verify the update number. Updating isn’t optional, but you’ll likely need help from IT because patches can break custom macros, plug-ins, or license servers. Don’t ignore update prompts; report them to your support team immediately.

For IT Administrators

This is a multi-headed inventory challenge. You must locate every instance of each affected application across your organization, determine its exact build number, and apply the corresponding fix from Siemens. Some products need a specific update pack; for example, Solid Edge SE2026 requires Update 04 or later, while Solid Edge SE2025 needs Update 13. Merely deploying “the latest” could leave systems vulnerable if the update channel doesn’t match.

The scale can be daunting: a single engineering firm may run COMOS, NX, Teamcenter Visualization, and Tecnomatix on hundreds of workstations, with different release tracks in use. Additionally, for the three products still awaiting fixes, you’ll need to implement compensating controls now.

For Security Teams

Treat this as a post-compromise risk amplifier. Engineering endpoints are high-value targets — they hold proprietary designs, simulation data, and often have broad access to PLM repositories and manufacturing networks. A successful escalation here isn’t just about workstation compromise; it can lead to exfiltration of trade secrets or manipulation of production specifications. Because the attack requires no user interaction, it can be weaponized by automated malware as part of a lateral movement chain. Shared workstations, jump hosts, and virtual desktop infrastructure (VDI) deployments amplify the risk: one compromised user can leave a backdoor for others.

How We Got Here — The Shared SDK Problem

Siemens IAM Client is a common authentication and identity module used across the company’s industrial software portfolio. Instead of building login and rights-management logic from scratch, product teams embed this SDK. That consistency saves development time but creates a single point of failure: one bug propagates everywhere.

The unquoted search path class of vulnerability is well understood in Windows environments. Improper handling of file paths — especially those containing spaces — can lead to unexpected resource loading. When a program calls, say, C:\Program Files\Vendor\app.exe without quotation marks, Windows may try to execute C:\Program.exe first if it exists, and an attacker who can plant a file in a parent directory can hijack the execution. The IAM Client SDK’s flaw likely stems from similar unsafe path resolution during privileged operations.

Siemens first published its advisory on July 14, 2026. CISA republished it on July 21 to boost visibility among critical infrastructure sectors. The staggered fix availability reflects the engineering reality: each application must be individually repackaged with a patched SDK, tested, and released — a process that can take months for complex products.

What to Do Now

1. Inventory your Siemens software estate

Build an accurate list of every affected product, down to the exact version number. Use endpoint management tools, deployment records, or manual checks on critical systems. Note that Windows “Add or Remove Programs” may show only the product name, not the full build information needed for verification. For Solid Edge, for example, you need the update level; for Teamcenter Visualization, the dot release.

2. Map to fixed versions

Refer to the table above. For each installation, confirm whether the current build meets or exceeds the fixed version. If your number is lower, you’re vulnerable. Pay special attention to the products where fixes are pending: these require immediate compensating controls.

3. Apply vendor fixes where available

Download and install the patches from Siemens’ support portal. Test first on a non-production machine that mirrors your engineering environment — validate license handling, plug-in compatibility, and connection to PLM or simulation backends. A poorly tested update can halt design work, so coordinate with engineering leads on maintenance windows.

4. Deploy compensating controls for delays

If a fix isn’t ready or you must wait for a maintenance window, implement these mitigations:
- Restrict write permissions on application installation directories and any custom search paths. Ensure only SYSTEM and administrators can modify C:\Program Files, C:\Program Files (x86), and vendor-specific folders.
- Use Windows Defender Application Control (WDAC) or AppLocker to allow only signed executables and libraries from trusted publishers. Harden the policy so that user-writable folders like %TEMP% and Downloads are not execution points.
- Monitor for anomalous process behavior with EDR: look for Siemens processes spawning cmd.exe or PowerShell, loading unsigned DLLs from temporary folders, or accessing C:\ directly.
- Reduce local admin rights on engineering workstations. If a user must have admin privileges for legacy software, isolate that workload in a virtual machine or use privilege management tools.

5. Harden the workstation itself

• Segment engineering networks from manufacturing execution and enterprise IT. Use firewalls and jump hosts to limit lateral movement.
• Audit shared workstation configurations: disable guest accounts, enforce individual logins, and clear user profiles after each session.
• Review remote access settings. VPN gateways should require endpoint compliance checks; if a vulnerable Siemens app runs on a compromised remote client, the VPN becomes a tunnel for attack.

Outlook

Siemens is actively developing fixes for Simcenter Nastran, Simcenter STAR-CCM+, and Tecnomatix Process Simulate. Bookmark the vendor’s advisory page (SSA-288252) and check it weekly. As new patches drop, prioritize them using the same risk logic: shared workstations first, then high-IP-value systems, then lab machines.

Longer term, this incident should reset how your organization treats engineering endpoints. These aren’t ordinary desktops; they house the digital crown jewels. Apply the same security rigor you’d give domain controllers: hardened builds, strict change management, and continuous monitoring. The IAM Client flaw is a manageable vulnerability — if you act now.