CVE-2026-11756: Critical Unauthenticated RCE in Dassault 3DEXPERIENCE

Executive Summary

A maximum-severity deserialization vulnerability in the 3DEXPERIENCE Station Launcher App allows an unauthenticated, network-adjacent attacker to execute arbitrary code on any workstation running the affected application. Dassault Systèmes' 3DEXPERIENCE platform is a core PLM/CAD/simulation suite heavily used in aerospace, automotive, and defence manufacturing — making this vulnerability exceptionally high-impact in industrial and supply chain contexts.

CVSS Score: 10.0 (Critical)

The vulnerability (CWE-502 — Deserialization of Untrusted Data) requires no authentication and no user interaction. A patch has been issued via the Dassault Systèmes Trust Center.

Vulnerability Overview

Affected Versions

Technical Details

The Station Launcher App is a client-side component embedded in Dassault's 3DEXPERIENCE ecosystem that handles application launch orchestration across the PLM suite. The vulnerability stems from the Launcher's deserialization pipeline, which processes attacker-supplied network input without validating or sanitising object graphs before instantiation.

How Deserialization Exploits Work

1. Attacker identifies a 3DEXPERIENCE workstation with Station Launcher exposed
2. Attacker crafts a malicious serialized payload (gadget chain targeting available Java/native libraries)
3. Payload sent to the Launcher's listening service — no credentials required
4. Launcher deserializes the payload, instantiating attacker-controlled objects
5. Gadget chain triggers arbitrary OS command execution in the Launcher process context
6. Full compromise of the workstation — lateral movement, credential harvest, CAD/PLM data exfiltration

Impact in Industrial Environments

3DEXPERIENCE is widely deployed in sectors where workstations hold high-value intellectual property:

A single exploited workstation provides a foothold for lateral movement across corporate networks — particularly dangerous in environments where 3DEXPERIENCE is integrated with ERP, PLM, and engineering data management systems.

Remediation

Immediate Actions

1. Apply the Dassault Systèmes Security Patch

Obtain the update from the official advisory at:

https://www.3ds.com/trust-center/security/security-advisories

Follow the release-specific patching guide for your 3DEXPERIENCE release (R2023x–R2026x).

2. Network-Level Mitigation (if immediate patching is not possible)

Restrict access to the Station Launcher service at the host firewall:

# Block inbound connections to the Launcher's listening port from untrusted networks
# (Identify the specific port via netstat/ss on affected workstations)
# Windows:
netsh advfirewall firewall add rule name="Block 3DX Launcher External" ^
  dir=in action=block protocol=TCP localport=<launcher_port>
 
# Linux:
iptables -A INPUT -p tcp --dport <launcher_port> -j DROP

3. Monitor for Exploitation Indicators

# Look for anomalous child processes spawned from the Launcher process
# Windows Event Log — suspicious process creation under Station Launcher
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
  Where-Object {$_.Message -match 'launcher' -or $_.Message -match '3dx'}
 
# Check for unexpected outbound connections from workstations
netstat -an | findstr ESTABLISHED

Detection Indicators

Post-Remediation Checklist

1. Confirm patch applied to all 3DEXPERIENCE workstations in scope
2. Audit Launcher process activity logs for signs of prior exploitation
3. Rotate credentials for accounts that ran the Station Launcher App
4. Review network firewall rules — restrict Launcher reachability to authorised hosts only
5. Verify integrity of CAD/PLM repositories for signs of data access or modification
6. Coordinate with Dassault Systèmes support for further technical guidance

References

• NIST NVD — CVE-2026-11756
• Dassault Systèmes Trust Center — Security Advisories
• CWE-502: Deserialization of Untrusted Data