What is the CVSS score of CVE-2026-17061?

CVE-2026-17061 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of SIMULIA Execution Engine are affected by CVE-2026-17061?

Dassault Systèmes SIMULIA Execution Engine (releases 2023-2026) contains a critical vulnerability enabling unauthenticated remote attackers to seize complete control of exposed simulation…

How to fix or mitigate CVE-2026-17061?

Within 24 hours: inventory all SIMULIA Execution Engine servers running releases 2023-2026 across your environment and document their network exposure; immediately implement firewall rules restricting SIMULIA server access to internal networks and authorized engineering teams only, blocking all external connections. Within 7 days: deploy network segmentation to isolate SIMULIA systems from internet-facing infrastructure; configure intrusion detection systems and input monitoring to detect malicious serialized object submissions; implement strict access logging and alerting for all SIMULIA server activity. Within 30 days: contact Dassault Systèmes support to confirm patch availability and expected timelines; conduct business continuity assessment to prepare contingency procedures for potential SIMULIA compromise; evaluate architectural improvements such as air-gapping critical simulation systems or restricting SIMULIA deployment to isolated networks.

SIMULIA Execution Engine CVE-2026-17061

EUVD-2026-56155 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-11 3DS

GHSA-qfh4-7rqm-ph5w

RCE Deserialization Simulia Execution Engine Dassault Syst Mes

10.0

CVSS 3.1 · Vendor: 3DS

Severity by source

Vendor (3DS) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network deserialization RCE gives AV:N/AC:L/PR:N/UI:N with full C/I/A loss; I assess S:U as code executes within the engine's own authority (score 9.8), whereas the vendor rated S:C for 10.0.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (3DS).

CVSS VectorVendor: 3DS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 15:09 vuln.today

CVE Published

Aug 11, 2026 - 14:21 cve.org

CRITICAL 10.0

DescriptionCVE.org

A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.

AnalysisAI

Unauthenticated remote code execution in Dassault Systèmes SIMULIA Execution Engine (Release 2023 through Release 2026) allows a network attacker to run arbitrary code on the server by submitting a malicious serialized object that the application deserializes without validation. The flaw carries a maximum CVSS 3.1 base score of 10.0 and requires no privileges or user interaction, making any exposed instance fully compromisable. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause combined with a network attack vector makes it a high-priority patching target.

Technical ContextAI

SIMULIA Execution Engine (formerly SimManager) is the server-side orchestration and simulation process/data management (SPDM) component of Dassault Systèmes' SIMULIA CAE portfolio, coordinating distributed simulation jobs and storing engineering simulation data. The vulnerability is classed as CWE-502 (Deserialization of Untrusted Data): the engine accepts serialized object data from a remote client and reconstructs it into live objects without first validating or restricting the object types, allowing an attacker to smuggle a crafted object graph (a gadget chain) that executes code during or after deserialization. Such flaws are common in Java-based enterprise middleware where native serialization endpoints are exposed; the exact affected package is identified by CPE cpe:2.3:a:dassault_systèmes:simulia_execution_engine:*:*:*:*:*:*:*:*, spanning all builds from Release 2023 to Release 2026.

RemediationAI

Consult the Dassault Systèmes advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-17061 and apply the vendor-supplied fix or patched release for your installed version; a specific fixed version number is not present in the available data, so treat patch status as 'Patch available per vendor advisory' and confirm the exact target build directly with 3DS support before deploying. Until patched, remove the Execution Engine from any internet exposure and restrict network access to its service endpoints so that only trusted, authenticated application tiers and administrative hosts can reach it - placing it behind a firewall or reverse proxy that blocks the deserialization-handling endpoint from untrusted clients; the trade-off is that legitimate distributed simulation clients on other subnets may lose connectivity and require allow-listing. Where feasible, front the service with network monitoring/WAF rules that flag serialized-object payloads, accepting that such filtering is best-effort and can be bypassed by novel gadget chains. Do not rely on authentication controls as a mitigation, since the flaw is exploitable without any privileges.