PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7858 Dassault Systèmes CVE debrief

A critical deserialization vulnerability in Dassault Systèmes' Teamwork Cloud and Magic Collaboration Studio products enables unauthenticated remote code execution. The flaw stems from unsafe deserialization of untrusted data (CWE-502) across multiple product releases from 2022x through 2026x. The CVSS 3.1 score of 9.8 reflects network attack vector, low complexity, no privileges required, and no user interaction needed, with high impact across confidentiality, integrity, and availability. The vendor has published a security advisory acknowledging the issue. No known exploitation in ransomware campaigns has been documented, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Vendor
Dassault Systèmes
Product
Teamwork Cloud - Standard Edition
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running affected Dassault Systèmes collaboration platforms, particularly those with internet-accessible instances. Security teams responsible for engineering software supply chains and product lifecycle management (PLM) environments should prioritize assessment and patching.

Technical summary

The vulnerability exists in the deserialization handling within Teamwork Cloud (No Magic Release 2022x through 2026x) and Magic Collaboration Studio (CATIA Magic Release 2022x through 2026x). An attacker can send crafted serialized data to the application without authentication, triggering insecure deserialization that leads to arbitrary code execution on the target system. The attack requires no user interaction and can be executed over the network with minimal complexity.

Defensive priority

critical

Recommended defensive actions

  • Apply security patches from Dassault Systèmes as they become available per the vendor security advisory
  • Restrict network access to Teamwork Cloud and Magic Collaboration Studio instances to authorized users and trusted networks
  • Monitor deserialization-related network traffic and application logs for anomalous activity
  • Review and update incident response procedures given the unauthenticated remote exploitation potential
  • Validate that security controls such as WAFs or application firewalls can detect and block deserialization attack patterns
  • Prioritize patching for internet-facing deployments of affected products

Evidence notes

CVE published and modified 2026-06-01. Vendor reference from [email protected] confirms affected product ranges and CWE-502 classification. NVD status: Awaiting Analysis. Vendor identification inferred from reference domain (3ds.com) with low confidence; requires review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7858 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7858

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7858 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7858

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.