EUVD-2026-56155
GHSA-qfh4-7rqm-ph5w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network deserialization RCE gives AV:N/AC:L/PR:N/UI:N with full C/I/A loss; I assess S:U as code executes within the engine's own authority (score 9.8), whereas the vendor rated S:C for 10.0.
Primary rating from Vendor (3DS).
CVSS VectorVendor: 3DS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
AnalysisAI
Unauthenticated remote code execution in Dassault Systèmes SIMULIA Execution Engine (Release 2023 through Release 2026) allows a network attacker to run arbitrary code on the server by submitting a malicious serialized object that the application deserializes without validation. The flaw carries a maximum CVSS 3.1 base score of 10.0 and requires no privileges or user interaction, making any exposed instance fully compromisable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the SIMULIA Execution Engine's service endpoint that accepts and deserializes client-supplied object data - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special configuration, no authentication, and no user interaction are needed against affected Release 2023-2026 installations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) describes the worst-case profile: remote, low-complexity, unauthenticated, no interaction, with total confidentiality/integrity/availability loss and a scope change, meaning compromise can extend beyond the vulnerable component's security authority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the SIMULIA Execution Engine over the network crafts a malicious serialized object payload and sends it to the engine's deserialization endpoint without needing any credentials. When the server reconstructs the object, an embedded gadget chain triggers execution of attacker-controlled code in the context of the engine process, giving the attacker a foothold on the simulation server and access to engineering simulation data. … |
| Remediation | Consult the Dassault Systèmes advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-17061 and apply the vendor-supplied fix or patched release for your installed version; a specific fixed version number is not present in the available data, so treat patch status as 'Patch available per vendor advisory' and confirm the exact target build directly with 3DS support before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all SIMULIA Execution Engine servers running releases 2023-2026 across your environment and document their network exposure; immediately implement firewall rules restricting SIMULIA server access to internal networks and authorized engineering teams only, blocking all external connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today