Dassault Systèmes vulnerabilities
We track 70 vulnerabilities in Dassault Systèmes products across 28 products. 70 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on October 12, 2026.
Latest Dassault Systèmes vulnerabilities
- 8.1 High severity
Tuleap Enterprise Edition: Authorization Bypass Through User-Controlled Key
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instanc
- 8.7 High severity
Tuleap Enterprise Edition: Improper Neutralization of Input During Web Page Generation
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
- 8.7 High severity
Tuleap Enterprise Edition: Improper Neutralization of Input During Web Page Generation
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
- 8.7 High severity
Tuleap Enterprise Edition: Improper Neutralization of Input During Web Page Generation
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
- 8.8 High severity
Tuleap Enterprise Edition: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.
- 9.9 Critical severity
GEOVIA Geospatial Data Manager: Improper Control of Generation of Code
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
- 8.8 High severity
Tuleap Enterprise Edition: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
- 9.3 Critical severity
3DSwymer: Improper Authorization
An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.
- 7.7 High severity
Tuleap Enterprise Edition: Use of Default Password
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
- 10.0 Critical severity
SIMULIA Execution Engine: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
- 10.0 Critical severity
Station Launcher App in 3DEXPERIENCE platform: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.
- 7.5 High severity
Tuleap Enterprise Edition: Authorization Bypass Through User-Controlled Key
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.
- 9.8 Critical severity
DELMIA Apriso: Improper Authentication
An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.
- 8.1 High severity
BIOVIA Workbook: Concurrent Execution using Shared Resource with Improper Synchronization
A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.
- 9.8 Critical severity
SOLIDWORKS Visualize: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attacker to write arbitrary files on the server.
- 8.7 High severity
DELMIA Service Process Engineer: Improper Neutralization of Input During Web Page Generation
A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary script code in user's bro
- 9.8 Critical severity
Teamwork Cloud - Standard Edition: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x could lead to an unauthenticat
- 9.1 Critical severity
DELMIA Factory Resource Manager: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to read or write files in specific directories on the server.
- 7.8 High severity
SOLIDWORKS Desktop: Improper Control of Generation of Code
A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitrary code on the user's machine while opening a specially crafted file.
- 8.7 High severity
ENOVIAvpm Web Access: Improper Neutralization of Input During Web Page Generation
A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session.
- 7.8 High severity
SOLIDWORKS eDrawings: Out-of-bounds Write
An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially craf
- 7.8 High severity
SOLIDWORKS eDrawings: Out-of-bounds Read
An Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially craft
- 7.8 High severity
SOLIDWORKS eDrawings: Use of Uninitialized Variable
A Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a speci
- 7.8 High severity
SOLIDWORKS eDrawings: Out-of-bounds Write
An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially craf
- 7.8 High severity
SOLIDWORKS eDrawings: Heap-based Buffer Overflow
A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a speciall
- 8.7 High severity
DELMIA Service Process Engineer: Improper Neutralization of Input During Web Page Generation
A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- 9.0 Critical severity
Station Launcher App in 3DEXPERIENCE platform: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.
- 7.8 High severity
SOLIDWORKS eDrawings: Use of Uninitialized Variable
A Use of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
- 7.8 High severity
SOLIDWORKS eDrawings: Use After Free
A Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted PAR file.
- 7.8 High severity
SOLIDWORKS eDrawings: Out-of-bounds Read
An Out-Of-Bounds Read vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted PAR file.
- 9.1 Critical severity
Dassault Systèmes DELMIA Apriso Missing Authorization Exploited
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
- 8.0 High severity
Dassault Systèmes DELMIA Apriso Code Injection Exploited
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
- 7.8 High severity
SOLIDWORKS eDrawings: Use After Free
Use After Free vulnerability exists in the IPT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted IPT file.
- 7.8 High severity
SOLIDWORKS eDrawings: Use of Uninitialized Variable
Use of Uninitialized Variable vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
- 7.8 High severity
SOLIDWORKS eDrawings: Use After Free
Use After Free vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
- 7.8 High severity
SOLIDWORKS eDrawings: Use After Free
Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted CATPRODUCT file.
- 7.8 High severity
SOLIDWORKS eDrawings: Use After Free
Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted CATPRODUCT file.
- 7.8 High severity
SOLIDWORKS eDrawings: Out-of-bounds Read
Out-Of-Bounds Read vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
- 8.7 High severity
Project Portfolio Manager: Improper Neutralization of Input During Web Page Generation
A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- 9.0 Critical severity
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Exploited
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.