3DEXPERIENCE hit by a perfect 10.0 flaw: CVE-2026-11756 targets the designer's PC

On July 27, 2026, Dassault Systèmes disclosed a vulnerability scored at a perfect 10.0 in the 3DEXPERIENCE platform — the foundation that CATIA, SOLIDWORKS and the rest of the company's design software runs on. It needs no login and no user interaction, and it lets an attacker run arbitrary code from outside.

The affected component is the "Station Launcher App", and it does not sit in a data centre. It runs on the workstations designers use every day. Every current generation is affected, from R2023x in 2023 through the latest R2026x. This is not a legacy-version problem.

There are no reports of real-world attacks so far, and no public exploit code. The awkward part is different: Dassault has not published which build fixes it. Finding out requires a login to the customer support portal. Below we walk through what the flaw is, whether you are affected, and what to do. The same vendor disclosed an unauthenticated takeover of its design-data collaboration server only in June.

What a severity of 10.0 actually means

Vulnerability severity is expressed on CVSS, a shared 10-point scale. Anything from 9.0 up is the top "critical" tier, but CVE-2026-11756 sits at the ceiling: 10.0. Out of the tens of thousands of flaws published each year, only a handful ever score a perfect ten.

It reaches the maximum because none of the usual preconditions apply and the damage is judged to spread beyond the component itself. Broken down: it is exploitable over the network (AV:N), the attack is not difficult (AC:L), no privileges and no login are required (PR:N), and the user does not have to do anything (UI:N). On top of that, control is judged to escape the compromised component's own security boundary (S:C). That last item is precisely what separates a 9.8 from a 10.0.

The flaw class is unsafe deserialization. When programs exchange data they "pack" it into a transportable form and "unpack" it at the other end. If the unpacking step trusts whatever arrives and reconstructs it faithfully, an attacker can craft data that executes as instructions the moment it is restored. This pattern has recurred for years in enterprise Java software — the same mechanism was recently behind the takeover flaw in the widely used Java library Fastjson.

The target is a designer's PC, not a server

The detail that matters most operationally is where the affected code lives. The Station Launcher App is not on a data-centre server; it is installed on each individual engineer's workstation.

Per Dassault's own documentation, Station Launcher "starts a local, private station on your computer that you can use to run simulations." The same material notes that no other user on the network can run simulations on your station. Worth understanding alongside it is the 3DEXPERIENCE Launcher, its prerequisite: a background service that exists so the browser can start native desktop applications such as SOLIDWORKS Connected and CATIA. To do that, it holds a listening port open on the workstation. That architecture is what makes a network-borne attack (AV:N) plausible against a desktop component.

The operational consequence follows directly. Remediation is a fleet update across engineering workstations, not a scheduled server maintenance window. You cannot close this in an overnight change slot; you have to find machines that are in use during working hours, across departments. Engineering endpoints are also frequently excluded from standard corporate patch distribution, because CAD licensing and validated configurations demand it. The first task is simply counting how many machines are in scope.

Who goes after this, and why

Manufacturing design environments attract a different crowd from the bots that sweep the web at random. The realistic threats here are industrial-espionage actors who will spend weeks looking for a way in because they want one specific company's drawings and simulation data, and ransomware crews who want to stop production. Both understand that an engineer's workstation sits about as close to the crown jewels as a machine can.

What they use the flaw for is taking the designer's PC as a first foothold, then walking into the company's product-data systems as a legitimate user. Those workstations hold saved credentials for 3DEXPERIENCE. Take the endpoint and you inherit an authorised path into the heart of product lifecycle management. Detection tooling struggles here, because a valid account performing valid operations is exactly what it is designed not to block.

What ultimately gets lost varies by sector. Exfiltrated drawings and analysis results erode a product advantage the moment they reach a competitor. Reach the production systems and encrypt them, and the plant stops — along with the delivery schedules of everyone downstream. In Japan, seven manufacturers disclosed ransomware incidents in March 2026 alone (Japanese-language coverage), and the pressure on design and production systems has not let up.

Affected versions at a glance

This is the scope Dassault published. For each generation, everything at or below the listed Fix Pack level (FP.CFA) is affected. Match your generation and update level against this table.

Note that the newest generation, R2026x, is in scope too. "We are on the latest release" is not reassurance here. On the other side of the ledger, only the Station Launcher App is affected — Dassault explicitly marks the rest of the platform as unaffected. If you run 3DEXPERIENCE without that component, you are outside the scope.

The fixed build has not been published

This is the part that grates. For a flaw scored at the maximum, Dassault's public advisory does not say which update level resolves it. There is no workaround section and no credit to a reporter. What it contains is the affected scope and a button labelled "Access remediation information."

Behind that button is knowledge-base article QA00000460378, and opening it requires a customer support account. Without a login you get nothing. In effect, "are you at risk" is public while "how do you fix it" is behind a contract.

Reading the version ceilings in the table, the next Fix Pack on each release is the likely fix — but that is our inference from the affected ranges, not something Dassault states. Confirm the build you actually need through a colleague with support access reading QA00000460378, or through your reseller.

To be fair, this is Dassault's standard advisory format rather than something specific to this CVE. The June Teamwork Cloud advisory and the July DELMIA Apriso one withhold fixed builds, workarounds and credits in exactly the same way. That is not unusual for enterprise software — but at 10.0, days after disclosure, it lengthens the window in which internal teams are still "checking".

The same component had a critical flaw nine months ago

This is not the first serious hole in the Station Launcher App. On October 13, 2025, CVE-2025-9976 covered an OS command injection in the very same component that allowed arbitrary code execution on the user's machine, scored 9.0, affecting R2022x through R2025x.

The difference is the bar for exploitation. CVE-2025-9976 required the attacker to hold some privilege and required user interaction. CVE-2026-11756 needs neither. The same structural weakness has resurfaced in a distinctly worse form. Twice in nine months is a reasonable basis for treating this component as a recurring patch item rather than a one-off.

Across Dassault's whole portfolio, 17 vulnerabilities have been published in 2026. Four of them are 9.8 or above, including this one: Teamwork Cloud in June (CVE-2026-7858), SOLIDWORKS Visualize in June (CVE-2026-10094), and DELMIA Apriso in July (CVE-2026-9695). The product line is under broad scrutiny, from design through to manufacturing execution.

Who runs 3DEXPERIENCE

3DEXPERIENCE is deeply embedded in manufacturing, and Japanese industry is a good illustration of the scale. Drawing only on Dassault's own customer stories and its Japan conference records, adopters include Toyota Motor, Honda, SUBARU and Yamaha Motor in mobility; Alps Alpine, Toyo Tire and Musashi Seimitsu in components; Kobelco Construction Machinery and Takeuchi in heavy equipment; Jamco in aircraft interiors; Taisei in construction; and Shiseido and ASICS in consumer goods.

Being named here does not mean any of these companies was affected by this vulnerability. The flaw is confined to one component, and which configuration and update level each customer runs is not public. Read the list as an indication of how broadly the platform underpins manufacturing, nothing more.

As of now, Japan's JVN and JPCERT/CC have issued no advisory on this, and there is no press coverage in any language. Flaws in design infrastructure tend to stay invisible until they hit a delivery date. The wider CAD and PLM space has drawn steady attention this year, with critical issues also published in PTC Windchill and Autodesk Fusion.

What IT teams should do now

Here is the sequence that is cheapest to run while nothing is being exploited.

Step 4 is there because patching will probably take a while. Dassault publishes no workaround, so this is ordinary network segmentation thinking rather than vendor guidance — but it is worth confirming that the port an engineer's workstation holds open is not directly reachable from outside the network or from unrelated segments. In environments with remote work or VPN access, that reach is often wider than assumed.

This flaw is not currently listed in CISA's catalogue of vulnerabilities confirmed to be under attack (KEV). There is no EPSS exploitation-likelihood score yet either, and no exploit code has surfaced. But in 2025, three Dassault DELMIA Apriso flaws (CVE-2025-5086, CVE-2025-6204, CVE-2025-6205) reached KEV within weeks of disclosure. Given that this vendor's products have genuinely been hunted before, the quiet period is the cheap time to act.

Summary

CVE-2026-11756 is an unsafe-deserialization flaw in the Station Launcher App of 3DEXPERIENCE — the platform under CATIA and SOLIDWORKS — that allows arbitrary code execution with no login and no user interaction. Severity is a maximum 10.0 and every generation from R2023x to R2026x is in scope. No attacks, no exploit code and no press coverage have appeared so far.

Three things matter in practice. First, the target is a designer's PC, not a server, so this is endpoint fleet work. Second, the newest R2026x is affected, so being current is not protection. Third, the fixed build is not published, so confirming it requires someone with a support contract. Start by counting the affected machines and their update levels — that is the step nothing else depends on. We will update this article as the fix information, exploitation status or a KEV listing changes.

Sources

• ▸ Dassault Systèmes - CVE-2026-11756 security advisory
• ▸ NVD - CVE-2026-11756
• ▸ NVD - CVE-2025-9976 (the previous Station Launcher App flaw)
• ▸ Dassault Systèmes Support - QA00000460378 (remediation, login required)
• ▸ Dassault Systèmes - 3DEXPERIENCE Launcher services
• ▸ Dassault Systèmes - Security advisories index
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ Dassault Systèmes - Product portfolio (brands on 3DEXPERIENCE)