CATIA design-data server hijacked without login: CVE-2026-7858 (and DELMIA XSS CVE-2026-9024)

A critical flaw has been found in Teamwork Cloud (Magic Collaboration Studio), the design-data collaboration server in the CATIA family, that lets an attacker take over the server without logging in. Dassault Systèmes, the French company behind it, disclosed the issue on June 1, 2026. Its severity score is 9.8 out of 10 (the highest band) under CVSS, and it is tracked as CVE-2026-7858.

On the same day, a second flaw was disclosed in DELMIA, which manages shop-floor work instructions (CVE-2026-9024, CVSS 8.7). Both products are widely used as design and production backbones across manufacturing. This article walks through what is at risk, whether your organization is affected, and what to do now.

The two vulnerabilities at a glance

Here are both flaws side by side. The serious one is the first: an unauthenticated takeover (CVSS 9.8). The second is a screen-tampering flaw that abuses a logged-in user (CVSS 8.7).

"Remote code execution" means an attacker can run their own commands on your server across the network. "Unauthenticated" means they can do it without logging in. When both are true, you have the worst possible combination. More on this below.

When the blueprint vault is left unlocked, here is what walks out

The most dangerous thing about this flaw is that it needs no ID and no password. If the design-data server is merely reachable from the internet or the corporate network, industrial spies, contract hackers hired by rival manufacturers, and ransomware crews chasing a payout can walk straight past the login screen. What is stacked inside is the chassis design of a new car, the structural model of an aircraft, the specifications of defense equipment, drawings of products not yet released, and the full history of who changed what and when. The moment a crafted piece of data is sent to the server, those design assets are siphoned out wholesale to the attacker's machine.

Stolen design data does not only end up on dark-web markets. Funneled to a state-owned manufacturer in a rival country, a decade of R&D; can be copied in months and overtaken in the market. Supplier names and contacts embedded in the drawings become fuel for fake-invoice fraud that impersonates a trusted partner. And because taking over the server also lets the attacker rewrite the design data, a drawing with a single dimension shifted can flow to the floor and seed a recall-grade defect.

The cleanup falls on the manufacturer's IT department that ran the server. A design-data leak can trigger notifications to partners, reports to the privacy regulator, and, for defense-related work, contract termination or a government investigation. The number 9.8 does not capture the lost trust or the surrendered technical edge, costs you cannot convert to a figure after the fact. Whether you can apply the fix now is what decides if you have to carry that weight at all.

What is "Teamwork Cloud," exactly?

Dassault Systèmes is the French company known for CATIA, the 3D design software used in automotive, aerospace, space, and defense engineering. The product at the center here, Teamwork Cloud, originally came from the "No Magic" brand. It is a shared server where multiple engineers edit, store, and version-control large design models in parallel. It is also offered externally under the name "Magic Collaboration Studio (CATIA Magic)."

What it holds is not just drawings. Using an approach called Model-Based Systems Engineering (MBSE)—which structures how a product is built from which parts and which performance targets it must meet—it serves as the hub for models built in Cameo Systems Modeler and MagicDraw. In other words, it is a vault where a company's entire design know-how gathers.

It is deployed across manufacturing, defense, and aerospace through resellers as well. A vault door that opens without a login—that is what the score of 9.8 means here.

CVE-2026-7858: the design-data server taken over without a login

The first flaw, CVE-2026-7858, is classed as "deserialization of untrusted data." Programs often rebuild data received from outside back into its original form before using it. If that rebuilding step is tampered with, commands hidden inside the data get executed as-is—that is the essence of this class of flaw.

According to Dassault's security advisory and the NVD (the U.S. vulnerability database), the only condition for attack is "reachable over the network"—no login and no user action such as a click (the CVSS breakdown is AV:N/AC:L/PR:N/UI:N). If the server sits where an attacker can reach it, that alone allows remote arbitrary command execution and full takeover of the server.

Affected are all releases of Teamwork Cloud and Magic Collaboration Studio from 2022x through 2026x. Dassault provides remediation steps in a members-only knowledge-base article (QA00000455613), and organizations on an affected version need to apply the fix immediately.

CVE-2026-9024: stored screen-tampering in the shop-floor instruction app

The second flaw, CVE-2026-9024, was found in "Process Experience Studio" inside DELMIA Service Process Engineer, the role that builds product service/maintenance processes and work instructions in 3D. The flaw type is "stored cross-site scripting": an attacker plants a malicious script into an input field, has it saved, and then has it run in the browser of another user who opens that screen.

Unlike the first flaw, this one requires a login (low privilege is enough) and the user opening the screen, so the severity is 8.7—still in the "High" band. If the planted script runs, it could let an attacker act as the logged-in user or steal information shown on screen. Affected versions are 3DEXPERIENCE R2024x through R2026x. Remediation is described in knowledge-base article QA00000456163.

The same "type" of flaw has already been exploited

As of June 1, 2026, there is no public report (such as listing in CISA's Known Exploited Vulnerabilities, or KEV, catalog) that these two flaws have already been used in attacks. Still, you cannot relax, because the same "data rebuilding" type of flaw in Dassault products was exploited only recently.

In September 2025, CVE-2025-5086 (CVSS 9.0) in the manufacturing execution system "DELMIA Apriso" was added to CISA's KEV list. It too was "deserialization of untrusted data," and per SonicWall's analysis, attackers were observed sending crafted SOAP requests to launch an executable on the server and deploy spyware that logged keystrokes and captured screenshots.

Then in October 2025, CISA warned that two more DELMIA Apriso flaws, CVE-2025-6204 and CVE-2025-6205, were also being exploited. As CSO Online reported, core manufacturing systems are high-value targets because attackers can halt design and production. The question is whether you can act before 9.8 follows the same path.

Quick check: is your organization affected?

Your priority depends on which product and version you run. Use the table to find your situation.

The exact fixed build numbers are listed in the members-only knowledge-base articles (QA00000455613 / QA00000456163) and are available through your support contact or reseller. We do not assert specific numbers here to avoid pointing you to the wrong build.

What IT teams should check now

The top priority is applying the fix for Teamwork Cloud (Magic Collaboration Studio). At the same time, confirm whether this server is directly reachable from the internet. A design-data collaboration server rarely needs to be open externally. If applying the fix will take time, narrowing the source of access with a firewall or VPN—so attackers cannot reach it in the first place—is a practical stopgap.

In the past Apriso exploitation, suspicious request source IPs and unfamiliar process launches were left behind as traces. To check whether you have already been breached, inspect the server's access logs and the behavior before and after applying the fix. For CVE-2026-9024 on the DELMIA side, apply the fix per the knowledge base, focusing on screens with user-facing input fields.

If you do not operate the system yourself and rely on a reseller or cloud provider, asking them about their remediation status is the fastest route. To track vulnerabilities in widely used products together, see our roundup of major H1 2026 vulnerabilities.

FAQ

Summary

Of the two flaws disclosed by Dassault Systèmes, CVE-2026-7858 is an extremely dangerous one that lets an attacker take over a design-data collaboration server without logging in, striking the design backbone of manufacturers in automotive, aerospace, and defense. The same type of flaw in Dassault products was actually exploited in 2025, so the most important thing this time is to "close the hole while it is freshly disclosed and before attacks arrive." Organizations on an affected version should make applying the fix and blocking external exposure their top priority.

References

• ▸NVD - CVE-2026-7858 (Teamwork Cloud / Magic Collaboration Studio)
• ▸NVD - CVE-2026-9024 (DELMIA Service Process Engineer)
• ▸Dassault Systèmes - Security Advisories
• ▸Dassault Systèmes - No Magic Teamwork Cloud (product page)
• ▸Dassault Systèmes - Cameo Systems Modeler (MBSE)
• ▸The Hacker News - Critical CVE-2025-5086 in DELMIA Apriso Actively Exploited (Sept 2025)
• ▸SonicWall - Exploited in the Wild: DELMIA Apriso Insecure Deserialization
• ▸BleepingComputer - CISA warns of two more actively exploited Dassault vulnerabilities (Oct 2025)
• ▸CSO Online - DELMIA Apriso customers face patching emergency