EUVD-2026-33583
GHSA-wpwx-h3fg-2jh5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x could lead to an unauthenticated remote code execution.
AnalysisAI
Unauthenticated remote code execution in Dassault Systèmes Teamwork Cloud (No Magic Release 2022x-2026x) and Magic Collaboration Studio (CATIA Magic Release 2022x-2026x) arises from unsafe deserialization of attacker-controlled data. The CVSS 9.8 vector indicates a network-reachable attack with no privileges or user interaction, yielding full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and EPSS data was not provided.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Teamwork Cloud (No Magic Release 2022x-2026x) or Magic Collaboration Studio (CATIA Magic Release 2022x-2026x) is possible per the CVSS vector (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All CVSS sub-scores point to maximum severity: AV:N + AC:L + PR:N + UI:N means a remote, unauthenticated attacker can reach the vulnerable code path over the network with no user assistance, and C:H/I:H/A:H reflects full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on a network with reachability to the Teamwork Cloud or Magic Collaboration Studio service sends a crafted serialized object to an exposed endpoint; during deserialization, a gadget chain executes operating-system commands in the context of the service account. From there the attacker can read or tamper with hosted system models, pivot into engineering infrastructure, or deploy persistence on the host. … |
| Remediation | Patch available per vendor advisory - administrators should consult the 3DS security advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-7858 and upgrade Teamwork Cloud and Magic Collaboration Studio to the fixed build identified for their release train (exact fixed version not published in the input data, so the advisory itself is authoritative). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Teamwork Cloud and CATIA Magic Collaboration Studio instances (2022x-2026x) across production, staging, and development; immediately restrict network access via firewall rules to essential personnel only; disable systems if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today