CVE-2025-40800: Siemens Comos v10.6

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

Affected products

• Siemens Comos v10.6: before V10.6.1 (fixed in V10.6.1)
• Siemens NX v2412: before V2412.8700 (fixed in V2412.8700)
• Siemens NX v2506: before V2506.6000 (fixed in V2506.6000)
• Siemens Simcenter 3d: before V2506.6000 (fixed in V2506.6000)
• Siemens Simcenter Femap: before V2506.0002 (fixed in V2506.0002)
• Siemens Solid Edge SE2025: before V225.0 Update 10 (fixed in V225.0 Update 10)
• Siemens Solid Edge SE2026: before V226.0 Update 1 (fixed in V226.0 Update 1)

Published 2025-12-09. Last modified 2026-10-07.