What is the CVSS score of CVE-2026-11756?

CVE-2026-11756 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Station Launcher App CVE-2026-11756

EUVD-2026-49715 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-28 3DS.Information-Security@3ds.com

GHSA-r8wf-hwm5-pf4x

RCE Deserialization

10.0

CVSS 3.1 · Vendor: 3ds

Severity by source

Vendor (3ds) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (3ds) · only source for this CVE.

CVSS VectorVendor: 3ds

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 08:31 vuln.today

CVE Published

Jul 28, 2026 - 08:17 cve.org

CRITICAL 10.0

DescriptionCVE.org

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

AnalysisAI

Unauthenticated remote code execution in 3DEXPERIENCE Station Launcher App from Release R2023x through R2026x allows attackers to execute arbitrary commands on affected systems without any authentication. The flaw stems from deserialization of untrusted data (CWE-502) and carries a maximum CVSS 10.0 score. No active exploitation or public exploit code is reported at time of analysis, though the network‑accessible attack surface presents significant risk.