CVE-2026-11756: Unauthenticated RCE in 3DEXPERIENCE Station Launcher App
TL;DR - Critical deserialization flaw in 3DEXPERIENCE Station Launcher App can lead to unauthenticated remote code execution. - Affects verified releases R2023x through R2026x. - Patch guidance exists from the vendor, but the exact fixed build was not verifiable from available primary-source text.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-11756 |
| CVSS Score | 10.0 Critical |
| Attack Vector | Not published in the retrieved NVD vector details; impact indicates remote exploitation is possible |
| Auth Required | No, described as unauthenticated |
| Patch Available | Vendor advisory exists, but exact fixed version was not verifiable from retrieved primary-source text |
CVE-2026-11756 is a critical remote code execution issue in the Station Launcher App used by Dassault Systèmes 3DEXPERIENCE. NVD describes the bug as a deserialization of untrusted data vulnerability that can be exploited without authentication. That combination matters operationally: unauthenticated deserialization bugs often move quickly from disclosure to exploitation once researchers isolate the wire format or reachable code path.
The key limitation for defenders right now is that public details are incomplete. The NVD record confirms the affected release family and severity, and the vendor has published an advisory landing page, but the exact fixed build number was not visible from the retrievable advisory content in this research set. In practice, defenders should assume the issue is urgent across any environment running 3DEXPERIENCE Station Launcher App within the confirmed affected range until they validate remediation directly with vendor guidance.
What Is This Vulnerability?
At its core, CVE-2026-11756 is a deserialization of untrusted data issue. That means the vulnerable component appears to accept serialized input from an external source and reconstruct application objects from that data without sufficient validation or safety controls. When that process is unsafe, an attacker can sometimes trigger dangerous object creation, method invocation, or gadget-chain execution that results in arbitrary code running in the target process.
The NVD description is concise but important: this flaw in the Station Launcher App “could lead to an unauthenticated remote code execution.” That tells defenders two things. First, the vulnerable parsing path is reachable over a remote interface or exposed communication workflow. Second, no valid account is needed to reach the vulnerable condition. For internet-exposed systems or environments with broad internal reachability, that makes the flaw high priority even before exploit code is publicly available.
Because the available primary-source material does not expose the exact serialization format, protocol, endpoint, or vulnerable class path, defenders should avoid overfitting to one suspected implementation detail. It may involve Java serialization, .NET binary/object serialization, custom object transport, or another application-specific mechanism. The practical takeaway is not the exact gadget chain; it is that any service path where Station Launcher App processes serialized or structured remote input should be treated as potentially exploitable until patched.
Technical Notes
A generic deserialization exploitation workflow typically looks like this:
attacker-controlled input
-> application receives serialized object data
-> vulnerable deserializer reconstructs objects
-> magic methods / gadget chain / unsafe class resolution
-> arbitrary code execution in application context
If you are threat modeling affected deployments, focus on these questions:
1. Is Station Launcher App reachable from untrusted networks?
2. Does it accept structured remote messages, objects, or launcher/session data?
3. What account context does the app run under?
4. Can the service initiate child processes or load arbitrary libraries?
Who Is Affected?
The verified affected scope from NVD is the Station Launcher App in Dassault Systèmes 3DEXPERIENCE platform releases “from Release 3DEXPERIENCE R2023x through Release R2026x.” Based on currently retrievable primary-source information, that means defenders can confidently treat the following release families as affected: R2023x, R2024x, R2025x, and R2026x.
What is not yet confirmed from the retrieved advisory content is equally important. The available source set did not expose narrower sub-version boundaries, cumulative fix levels, hotfix IDs, or an explicit fixed version number. So if you run one of those release families, you should not assume that a later minor build within the same train is safe unless the vendor advisory or support channel explicitly says so. For change managers and asset owners, this means building an inventory at the release-family level first, then validating patch entitlement and installed package details against vendor documentation.
Organizations most at risk are those with 3DEXPERIENCE deployments accessible from partner networks, remote offices, contractor zones, or the public internet. Even when a platform is not internet-exposed, unauthenticated RCE remains a serious lateral movement risk inside flat or weakly segmented enterprise networks. Engineering, PLM, and manufacturing environments often have legacy trust assumptions and broad east-west connectivity, which can amplify the impact of a launcher-level compromise.
Technical Notes
Useful inventory commands will depend on how your deployment is packaged. If you do not have a clean SBOM or CMDB entry, start by identifying installed 3DEXPERIENCE components and launcher binaries.
# Linux: locate likely installation paths
find / -iname "*3dexperience*" -o -iname "*station*launcher*" 2>/dev/null
# Linux: inspect running processes
ps aux | egrep -i "3dexperience|station|launcher"
# Windows PowerShell: search installed software and services
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Select-Object DisplayName, DisplayVersion, Publisher |
Where-Object { $_.DisplayName -match '3DEXPERIENCE|Station Launcher' }
Get-Service | Where-Object { $_.DisplayName -match '3DEXPERIENCE|Station Launcher' }
If your environment uses centralized software inventory, query for these version families explicitly:
3DEXPERIENCE R2023x
3DEXPERIENCE R2024x
3DEXPERIENCE R2025x
3DEXPERIENCE R2026x
Station Launcher App
CVSS Score Breakdown
The published CVSS base score is 10.0, which is the maximum severity under CVSS v3.x. The full vector string was not returned in the available NVD output used for this article, so individual metric values cannot be quoted as verified facts. Still, the score aligns with the vulnerability description: remote, unauthenticated code execution in an enterprise application component typically maps to the most severe impact profile.
Why this matters operationally is that a 10.0 score usually implies several compounding traits: no privileges required, no meaningful user interaction, complete compromise potential, and straightforward reachability from an attacker-controlled position. Even without the full vector, the combination of “unauthenticated” and “remote code execution” strongly suggests defenders should treat this issue as an emergency patch candidate rather than a routine maintenance item.
In the absence of the complete vector string, defenders should assume the worst reasonable case for exposure management. That means prioritizing systems based on network accessibility and business criticality, not waiting for exploit telemetry to emerge. If a component that can execute code is reachable pre-auth, the window between advisory publication and reliable exploit development can be short.
Technical Notes
A typical CVSS 10.0 RCE often reflects attributes like these, though these exact values are not confirmed here without the official vector:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Potentially Changed or Unchanged
Confidentiality: High
Integrity: High
Availability: High
Defenders should rely on the verified facts, not assumptions:
Verified:
- CVSS base score: 10.0
- Impact: unauthenticated remote code execution
Not verified from retrieved source:
- Full CVSS vector string
- Exact metric-by-metric values
Exploitation Status
At the time of this writing, active exploitation in the wild is not confirmed from the available primary sources used here. Specifically, CVE-2026-11756 is not listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no KEV-backed confirmation of exploitation at this time. That does not prove the flaw is not being exploited; it only means there is no public CISA KEV evidence to cite.
Likewise, a public proof of concept is not confirmed from the available research set. No reliable primary-source exploit repository, vendor bulletin with exploit details, or clearly attributable public PoC tied to this CVE was identified in the material provided. For defenders, the correct interpretation is not “low risk,” but “high-impact flaw with incomplete public exploitation intelligence.” This is especially true for deserialization issues, where exploitability can become clearer once protocol details are reverse engineered.
The safest operational stance is to assume exploitation is plausible and that exposure matters more than current public exploit visibility. If your 3DEXPERIENCE environment is reachable from untrusted networks, treat this as a priority containment and patching event. If it is internally reachable only, prioritize segmentation and detection while validating the vendor remediation path.
Technical Notes
Current exploitation status summary:
Public PoC: Not confirmed
Active exploitation in the wild: Not confirmed
CISA KEV listing: No
Risk-based handling recommendation:
If exposed to the internet or partner-accessible networks:
- Treat as urgent
- Restrict access immediately
- Patch as soon as vendor guidance is validated
If internal only:
- Prioritize patching
- Add monitoring for anomalous launcher traffic and child process execution
- Review service account privileges
How to Detect It
Detection is currently challenging because public technical details are limited. There is no verified vendor-published IoC set in the retrieved sources, and the exact network path, port, or serialized payload format has not been confirmed here. That means defenders should focus on behavior-based detection around the Station Launcher App rather than waiting for a perfect signature.
Start by identifying where Station Launcher App runs, then monitor for unusual inbound connections, abrupt process crashes, unexpected child process creation, and suspicious outbound traffic from the launcher host or process. Because deserialization attacks often end in command execution, secondary artifacts can be more reliable than payload signatures. Unexpected shell launches, PowerShell activity, script interpreter spawning, or network egress from the application process should all be investigated.
You should also review web proxy, reverse proxy, application gateway, and host EDR telemetry around the time of disclosure for requests targeting 3DEXPERIENCE-related services from unusual sources. If the application logs request parsing or launcher session handling, search for malformed object data, deserialization errors, stack traces, and repeated pre-auth request failures from the same source.
Technical Notes
Example host-based detection ideas:
# Linux: look for suspicious child processes launched by the app
ps -eo pid,ppid,cmd --forest | egrep -i "station|launcher|java|sh|bash|curl|wget|python|perl"
# Linux: recent crashes or service restarts
journalctl -u <service-name> --since "2026-07-28 00:00:00"
journalctl --since "2026-07-28 00:00:00" | egrep -i "exception|deserialize|serialization|crash|segfault"
# Windows PowerShell: suspicious child processes
Get-WinEvent -LogName Security |
Where-Object { $_.Id -eq 4688 } |
Select-String -Pattern "powershell.exe|cmd.exe|wscript.exe|cscript.exe|mshta.exe"
Example log patterns to hunt for, adjusting to your log schema:
"deserialize"
"deserialization"
"serialization error"
"invalid object stream"
"StreamCorruptedException"
"ClassNotFoundException"
"unexpected token"
"pre-auth request"
"launcher session"
Example SIEM-style query pattern for process execution anomalies:
SELECT timestamp, host, parent_process, process_name, command_line
FROM process_events
WHERE lower(parent_process) LIKE '%station%'
OR lower(parent_process) LIKE '%launcher%'
OR lower(process_name) IN ('cmd.exe','powershell.exe','sh','bash','python','perl','wget','curl');
If you have network telemetry, create a temporary watchlist for unusual inbound traffic to systems hosting 3DEXPERIENCE Station Launcher App, especially from untrusted segments:
- repeated unauthenticated connection attempts
- bursts of failed requests followed by service restart
- large or malformed binary payloads
- new source IPs contacting launcher-related services
Mitigation and Patching
The preferred mitigation is to apply the vendor-provided fix from Dassault Systèmes. However, the exact fixed version number was not verifiable from the retrievable primary-source advisory content used for this article. That means defenders should consult the vendor advisory directly and, if necessary, open a support case to confirm the exact remediated build or hotfix for their release train before making change-control decisions.
Until that fixed version is confirmed and deployed, exposure reduction is the next-best control. Restrict network access to systems running the Station Launcher App so that only explicitly authorized management hosts, application tiers, or user segments can connect. If the app is not business-critical for all users, consider temporarily disabling the vulnerable service or removing external reachability until patching is complete. Also review the runtime account for the launcher and reduce privileges where possible to limit post-exploitation impact.
Because this is an unauthenticated RCE, compensating controls should prioritize reachability and execution constraints. Network segmentation, reverse proxy allowlisting, EDR prevention policies for common post-exploitation tools, and application control can all reduce risk during the remediation window. If your environment supports change windows only at specific times, document the exception and deploy interim ACLs immediately rather than waiting for the full patch cycle.
Technical Notes
The fixed version is currently unknown from the retrieved source set. Defenders should record that explicitly in internal tickets:
Verified affected range:
- 3DEXPERIENCE R2023x through R2026x
Verified fixed version:
- Unknown from currently retrieved primary-source text
- Must be confirmed via vendor advisory or support channel
Example temporary Linux firewall restriction:
# Replace with your approved admin subnet and service port
iptables -A INPUT -p tcp -s <admin-subnet>/24 --dport <service-port> -j ACCEPT
iptables -A INPUT -p tcp --dport <service-port> -j DROP
Example Windows Firewall restriction:
New-NetFirewallRule -DisplayName "Allow Station Launcher from Admin Subnet" `
-Direction Inbound -Action Allow -Protocol TCP `
-RemoteAddress <admin-subnet>/24 -LocalPort <service-port>
New-NetFirewallRule -DisplayName "Block Station Launcher from Others" `
-Direction Inbound -Action Block -Protocol TCP `
-RemoteAddress Any -LocalPort <service-port>
If the service can be temporarily disabled without breaking critical operations, document and execute that workaround:
# Linux systemd example
sudo systemctl stop <service-name>
sudo systemctl disable <service-name>
# Windows service example
Stop-Service -Name "<service-name>" -Force
Set-Service -Name "<service-name>" -StartupType Disabled
For package or platform upgrades, use vendor-approved procedures only. A placeholder change record should look like this until the exact fixed build is validated:
Action: Upgrade 3DEXPERIENCE Station Launcher App / platform components
From: affected release family (R2023x-R2026x)
To: vendor-confirmed fixed build for CVE-2026-11756
Source of truth: https://www.3ds.com/trust-center/security/security-advisories/cve-2026-11756
References
The primary reference for the vulnerability record is the National Vulnerability Database entry for CVE-2026-11756. That record confirms the vulnerability class, affected component, affected release range, and critical severity score. It is the most reliable public source for verified facts when vendor advisory details are incomplete or not fully retrievable.
The vendor advisory page from Dassault Systèmes is the authoritative source for product-specific remediation guidance and should be consulted directly for fixed build information, release-specific instructions, or support-channel updates. CISA’s Known Exploited Vulnerities catalog is also relevant for monitoring whether public exploitation becomes confirmed later.
Technical Notes
Primary sources:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11756
- Dassault Systèmes advisory: https://www.3ds.com/trust-center/security/security-advisories/cve-2026-11756
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Suggested defender follow-up:
1. Validate whether any 3DEXPERIENCE R2023x-R2026x deployments include Station Launcher App.
2. Confirm the vendor-fixed build or hotfix directly from Dassault Systèmes.
3. Restrict access to exposed instances immediately.
4. Add host and process monitoring around the launcher component.
5. Recheck KEV and vendor advisory status as new details emerge.
For more information on related vulnerabilities, you can check out our articles on identity attacks explained and the best MDR providers for SMBs in 2026.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.