CVE-2026-11756
The vulnerability allows an attacker to run arbitrary code on a system that runs the Station Launcher App in the 3DEXPERIENCE platform. It is triggered by deserializing untrusted data and does not require any user interaction or authentication. The flaw is present in releases from R2023x up to R2026x.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Station Launcher App in the 3DEXPERIENCE platform, releases R2023x through R2026x.
Real-world impact
An attacker could take full control of the affected system, steal data, install malware, or disrupt services, all without needing to log in or interact with the user.
Why this severity
The CVSS score of 10 reflects that the flaw is exploitable from the network, requires no authentication, and gives the attacker complete control over confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources