High 7.4Published Dec 9, 2025

CVE-2025-40800A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcente…

Updated under an hour ago (Oct 27, 2026, 8:50 AM ET)

Does this affect you?

It affects Siemens COMOS V10.6 and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Siemens COMOS V10.6

Exploited in the last 30 days

A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-295
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: siemens
NVD analysis: Deferred
Record last updated: Mar 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Siemens COMOS V10.6 siemens:comos_v10.6 (from the name)	before V10.6.1	CNA record
Siemens NX V2412 siemens:nx_v2412 (from the name)	before V2412.8700	CNA record
Siemens NX V2506 siemens:nx_v2506 (from the name)	before V2506.6000	CNA record
Siemens Simcenter 3D siemens:simcenter_3d (from the name)	before V2506.6000	CNA record
Siemens Simcenter Femap siemens:simcenter_femap (from the name)	before V2506.0002	CNA record
Siemens Solid Edge SE2025 siemens:solid_edge_se2025 (from the name)	before V225.0 Update 10	CNA record
Siemens Solid Edge SE2026 siemens:solid_edge_se2026 (from the name)	before V226.0 Update 1	CNA record

References

References

https://cert-portal.siemens.com/productcert/html/ssa-868571.html
https://cert-portal.siemens.com/productcert/html/ssa-212953.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.