PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7858 Dassault Systèmes CVE debrief

A critical deserialization vulnerability in Dassault Systèmes' Teamwork Cloud and Magic Collaboration Studio products enables unauthenticated remote code execution. The flaw stems from unsafe deserialization of untrusted data (CWE-502) across multiple product releases from 2022x through 2026x. The CVSS 3.1 score of 9.8 reflects network attack vector, low complexity, no privileges required, and no user interaction needed, with high impact across confidentiality, integrity, and availability. The vendor has published a security advisory acknowledging the issue. No known exploitation in ransomware campaigns has been documented, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Vendor
Dassault Systèmes
Product
Teamwork Cloud - Standard Edition
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Organizations running affected Dassault Systèmes collaboration platforms, particularly those with internet-accessible instances. Security teams responsible for engineering software supply chains and product lifecycle management (PLM) environments should prioritize assessment and patching.

Technical summary

The vulnerability exists in the deserialization handling within Teamwork Cloud (No Magic Release 2022x through 2026x) and Magic Collaboration Studio (CATIA Magic Release 2022x through 2026x). An attacker can send crafted serialized data to the application without authentication, triggering insecure deserialization that leads to arbitrary code execution on the target system. The attack requires no user interaction and can be executed over the network with minimal complexity.

Defensive priority

critical

Recommended defensive actions

  • Apply security patches from Dassault Systèmes as they become available per the vendor security advisory
  • Restrict network access to Teamwork Cloud and Magic Collaboration Studio instances to authorized users and trusted networks
  • Monitor deserialization-related network traffic and application logs for anomalous activity
  • Review and update incident response procedures given the unauthenticated remote exploitation potential
  • Validate that security controls such as WAFs or application firewalls can detect and block deserialization attack patterns
  • Prioritize patching for internet-facing deployments of affected products

Evidence notes

CVE published and modified 2026-06-01. Vendor reference from [email protected] confirms affected product ranges and CWE-502 classification. NVD status: Awaiting Analysis. Vendor identification inferred from reference domain (3ds.com) with low confidence; requires review.

Official resources

2026-06-01