Critical severity · published Jul 28, 2026
CVE-2026-11756
Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x
10.0
CVSS
0.8%
EPSS
No
On KEV
Description
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Station Launcher App in 3DEXPERIENCE platform · Dassault Systèmes
Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2613; Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2615; Release 3DEXPERIENCE R2025x Golden through Release 3DEXPERIENCE R2025x.FP.CFA.2628; Release 3DEXPERIENCE R2026x Golden through Release 3DEXPERIENCE R2026x.FP.CFA.2624 · source: vendor
Affected product
SL
Station Launcher App in 3DEXPERIENCE platform
Dassault Systèmes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11756
www.3ds.com
https://www.3ds.com/trust-center/security/security-advisories/cve-2026-11756
More from Station Launcher App in 3DEXPERIENCE platform
9.0
CVE-2025-9976
OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x