EUVD-2026-88650
GHSA-4j5g-4952-v4rh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege account on GEOVIA server
-
DeliverySend crafted input to injectable feature
-
ExploitCode injection evaluated server-side
-
ExecutionExecute arbitrary code in app context
-
ImpactEscape scope to compromise host/data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated session on the GEOVIA Geospatial Data Manager application (part of the Dassault Systèmes 3DEXPERIENCE platform), reachable over the network, on Release 3DEXPERIENCE R2024x through R2026x at or below the listed FP.CFA build levels (R2024x≤.2632, R2025x≤.2637, R2026x≤.2635). No user interaction and no high privileges are needed once authenticated (AV:N/AC:L/PR:L/UI:N). The primary limiting factors are the authentication requirement and the product's narrow, industry-specific (mining/geospatial) deployment footprint; upgrading to a fixed FP build removes exposure. |
| Impact | This is a genuinely high-priority vulnerability by technical severity. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable, low-complexity code injection requiring only low-level authentication and no user interaction, with a scope change and full confidentiality/integrity/availability impact - consistent with CWE-94 code injection yielding arbitrary code execution on the server. However, all runtime-exploitation signals are absent or unknown: no EPSS probability is provided, the CVE is NOT in CISA KEV, and no public POC is referenced (the only reference is the vendor's own 3DS security advisory). SSVC decision inputs (exploitation status, automatability, technical impact) were not supplied. So the picture is 'severe if reached, but no evidence of exploitation in the wild.' The one caveat to note explicitly: exploitation requires valid low-privilege access to the GEOVIA/3DEXPERIENCE environment (PR:L), which meaningfully limits the realistic attacker population compared to a PR:N flaw - the 9.9 headline should be read against that authentication requirement and the product's narrow deployment. Vendor-reported and vendor-scored only; no independent NVD analysis is present in the input to corroborate the vector. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on a GEOVIA Geospatial Data Manager instance (R2024x-R2026x) submits crafted input to a server-side feature that is injected and evaluated as code, achieving arbitrary code execution in the application's server context and pivoting beyond the app boundary (scope change). Because no user interaction is needed and complexity is low, a single authenticated request can trigger it. No public exploit code has been identified at time of analysis; the only source is the Dassault Systèmes advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.
RemediationAI
Upgrade GEOVIA Geospatial Data Manager to a fixed fix-pack level above the affected ceilings for the installed train - that is, beyond R2024x.FP.CFA.2632 on R2024x, beyond R2025x.FP.CFA.2637 on R2025x, and beyond R2026x.FP.CFA.2635 on R2026x - using the corrected builds identified in the Dassault Systèmes advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2026-84154; vendor-released patches are available per that advisory, so no workaround should be treated as a permanent substitute. Where immediate upgrade is not possible, the two controls that directly reduce exposure are authentication hygiene and network scoping: enforce least privilege so that low-privilege accounts capable of reaching the vulnerable application functionality are limited to users who genuinely need them (trade-off: reduces the pool of exploitable sessions but does not remove the code path), and restrict network access to the GEOVIA Geospatial Data Manager service to trusted internal segments or VPN clients rather than exposing it broadly (trade-off: impairs remote and partner access to the mining data workflows). Because the scope-changed rating implies lateral impact within the 3DEXPERIENCE deployment, also review account separation and segmentation between the GEOVIA Data Manager service and other platform components, and monitor application logs for anomalous server-side code execution or unexpected child processes spawned by the application user after the upgrade window.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-94 improper control of code generation (code injection) issue in the server-side components of GEOVIA Geospatial Data Manager, a mining and geospatial data management application delivered as part of the Dassault Systèmes 3DEXPERIENCE platform. According to the CPE data (cpe:2.3:a:dassault_systèmes:geovia_geospatial_data_manager), the affected product is the GEOVIA Geospatial Data Manager itself rather than the platform core, though the scope-changed (S:C) vector component indicates that successful code execution on the server can cross a security boundary and impact resources beyond the vulnerable component - a meaningful concern given that 3DEXPERIENCE deployments typically share authentication, data stores and application services across modules. The attack requires network reachability to the application (AV:N), needs no special conditions to exploit once a session exists (AC:L), and requires only low privileges (PR:L) with no victim interaction (UI:N), which is why confidentiality, integrity and availability impacts are all rated High. The vulnerable code-generation path is reached through normal application functionality exposed to authenticated users, so input validation and safe evaluation of user-supplied content in that server-side routine is the root problem class.
Know when Geovia Geospatial Data Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable code injection needing only low-privilege auth and no interaction; server-side code execution crossing the app boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (3DS).
CVSS VectorVendor: 3DS
DescriptionCVE.org
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
Executive ViewAI
Dassault Systèmes GEOVIA Geospatial Data Manager, deployed on 3DEXPERIENCE R2024x through R2026x, contains a critical authenticated code injection flaw (CVE-2026-84154) that allows a low-privilege user to execute arbitrary code and potentially pivot to other parts of the 3DEXPERIENCE environment. While no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis exist, the changed-scope metric means a single compromised account could impact broader business systems, making it a high-priority risk for organizations in mining and geospatial sectors. Leadership should ensure immediate compensating controls are in place to protect sensitive data and maintain operational continuity.
No vendor patch available. Interim mitigations include isolating affected GEOVIA Geospatial Data Manager instances on segmented networks, enforcing strict least-privilege access and monitoring low-privilege accounts for anomalous activity, deploying virtual patching or WAF rules if supported, and temporarily disabling non-essential instances until a patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB