CVE-2026-11756 | A Deserialization of Untrusted Data vulnerability affecting … | CVSS 10.0 CRITICAL

Description

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

Metadata

CVE ID: CVE-2026-11756
State: PUBLISHED
Assigner: 3DS
Reserved: 2026-06-09 07:11 UTC
Published: 2026-07-28 07:35 UTC
Last updated: 2026-07-28 12:53 UTC
Primary CWE: CWE-502
CWE-502 Deserialization of Untrusted Data
Vendor / Product: Dassault Systèmes / Station Launcher App in 3DEXPERIENCE platform
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Dassault Systèmes	Station Launcher App in 3DEXPERIENCE platform	—	Release 3DEXPERIENCE R2023x Golden ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2613, Release 3DEXPERIENCE R2024x Golden ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2615, Release 3DEXPERIENCE R2025x Golden ≤ Release 3DEXPERIENCE R2025x.FP.CFA.2628, Release 3DEXPERIENCE R2026x Golden ≤ Release 3DEXPERIENCE R2026x.FP.CFA.2624

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	CWE-502 Deserialization of Untrusted Data

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

https://www.3ds.com/trust-center/security/security-advisories/cve-2026-11756