SURIQ
Dassault Systemes has disclosed a deserialization flaw in the 3DEXPERIENCE Launcher and rated it CVSS 10.0, the maximum score. Tracked as CVE-2026-11756, it can lead to unauthenticated remote code execution, meaning an attacker needs no account and no help from the user to run code on an affected machine. If your engineering teams run 3DEXPERIENCE, the design and product-lifecycle platform behind tools like CATIA and ENOVIA, this is today's patching work.
The more telling detail sits underneath the score: this is the second critical code-execution bug in the same launcher component in roughly nine months, and this one is worse than the last.
What Dassault disclosed
The vulnerable piece is the Station Launcher App, the local helper the browser-based 3DEXPERIENCE platform uses to start and communicate with native applications installed on a user's workstation. The flaw is a deserialization of untrusted data (CWE-502): the launcher accepts a serialized object it should not trust and rebuilds it, which an attacker can turn into arbitrary code execution. Dassault's security advisory and the CVE record both put the CVSS 3.1 base score at the ceiling, 10.0. The rating assumes an attacker who is reachable over the network, holds no privileges, and needs nothing from a user, with an impact that jumps a trust boundary and takes confidentiality, integrity, and availability all the way down. The advisory does not spell out the exact attack path, so treat the unauthenticated, no-interaction rating as your planning assumption rather than waiting for a proof of concept to define the risk for you.
Four release families are affected: R2023x, R2024x, R2025x, and R2026x. Each is vulnerable up to a specific fix-pack level. Dassault lists the corrected fix pack for each in knowledge-base article QA00000460378 on its support portal.
| 3DEXPERIENCE release | Affected through fix pack | Action |
|---|---|---|
| R2023x Golden | FP.CFA.2613 | Apply the fix pack above this level |
| R2024x Golden | FP.CFA.2615 | Apply the fix pack above this level |
| R2025x Golden | FP.CFA.2628 | Apply the fix pack above this level |
| R2026x Golden | FP.CFA.2624 | Apply the fix pack above this level |
Why an engineering platform is worth an attacker's time
3DEXPERIENCE is not general IT software, so it is easy to file under niche and move on. That underrates it. Platforms like this hold the crown jewels of a manufacturer: CAD models, bills of materials, simulation data, the full design history of physical products. We made the same point when researchers reported a web shell on the login page of PTC Windchill (CVE-2026-12569), a competing product-lifecycle platform. Engineering and product-lifecycle systems are a quiet, high-value target precisely because the security team often does not own them, the engineering organization does.
Because the Station Launcher runs on each engineer's workstation rather than a central server, the exposure is the fleet of design machines, not one host. An unauthenticated code-execution primitive there is a foothold onto exactly the endpoints with the most sensitive intellectual property, and often with direct network paths into the design vaults those endpoints connect to.
The pattern: same component, second critical bug
In October 2025 Dassault patched CVE-2025-9976, an OS command-injection flaw (CWE-78) in the same Station Launcher App, rated CVSS 9.0. That one needed a low-privileged user and some user interaction to fire. CVE-2026-11756 removes both conditions: no privileges, no interaction, which is precisely how the score climbs from 9.0 to a full 10.0. Two maximum-tier bugs in one browser-to-native bridge in under a year is a signal about the component's trust boundary, not a coincidence to patch once and forget.
Patch this week, then hunt
No public exploit or in-the-wild exploitation has been reported at the time of writing, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog. That is the window to act in, not a reason to relax: a CVSS 10 unauthenticated flaw in named enterprise software draws exploit development quickly once the advisory is public.
- Patch. Update the 3DEXPERIENCE Launcher on every workstation to the fix pack above the affected level for your release (see the table and KB
QA00000460378). - Inventory first. The launcher installs per user, so find every machine that has it, not just the servers your patch tooling already tracks. Contractors and engineers on their own laptops are the easy miss.
- Hunt. Watch the launcher process for unexpected child processes such as a command shell or a script interpreter, and for outbound connections it does not normally make. A deserialization bug that ends in code execution almost always lands as a process the launcher would never legitimately start.
Suriq's managed detection watches endpoint process activity and maps anomalies to MITRE ATT&CK, so a launcher that suddenly spawns a shell surfaces as an alert rather than a log line nobody reads. Whatever you run for detection, the launcher-spawns-a-child pattern is the one to keep an eye on until every workstation is on the fixed fix pack.