3DSwymer CVE-2026-16279

Exploitation targets the 3DPassport authentication/SSO component of 3DSwymer on 3DEXPERIENCE R2023x through R2026x and requires victim user interaction (CVSS UI:R) - the attacker must induce a legitimate user to interact with attacker-controlled content or a crafted request against the authorization flow; it does not require the attacker to hold any prior credentials (PR:N). Limiting factors: the flaw yields access to 'some user accounts' rather than universal takeover, success is gated on that user interaction (so it is not fully automatable or wormable), and only 3DEXPERIENCE deployments running the affected 3DPassport/3DSwymer releases and reachable by the attacker are exposed. The exact configuration that makes an account exploitable is not detailed in the vendor description and should be verified against the 3DS advisory.

Signals are partially conflicting and should be weighed rather than taken at face value. The vendor-assigned CVSS 3.1 base score is 9.3 (Critical) on vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - network reachable, low complexity, no privileges, but requiring user interaction and yielding a scope change; the scope change plus C:H/I:H is what pushes it into critical territory. Counterbalancing this, the description scopes impact to 'some user accounts' (not blanket takeover), and exploitation requires victim interaction (UI:R), which lowers automatability and argues for targeted rather than mass exploitation. No EPSS probability, KEV status, or POC evidence was provided, so real-world exploitation likelihood cannot be confirmed from the input - the 9.3 reflects potential impact, not observed activity. Net: treat as a high-priority patch for 3DEXPERIENCE operators (SSO-component compromise is high blast-radius), but the UI:R requirement and account-scoped impact mean it is unlikely to be wormable or opportunistically automated.

An attacker crafts a malicious link or page targeting the 3DPassport authorization flow and delivers it to a legitimate 3DEXPERIENCE user via email or chat. When the victim interacts with it, the improper authorization check is subverted, allowing the attacker to gain access to that user's account and, through the SSO scope, associated 3DEXPERIENCE resources. No public POC or exploit code was identified in the provided data.