CVE-2026-11756 Overview
CVE-2026-11756 is an insecure deserialization vulnerability in the Station Launcher App component of the Dassault Systèmes 3DEXPERIENCE platform. The flaw allows unauthenticated remote code execution across releases from 3DEXPERIENCE R2023x through 3DEXPERIENCE R2026x. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data and carries a maximum CVSS 3.1 base score of 10.0 with a scope change. Because exploitation requires no authentication and no user interaction, any attacker with network access to the Station Launcher App can obtain code execution in the platform context.
Critical Impact
Unauthenticated remote code execution on 3DEXPERIENCE deployments with scope change, enabling full compromise of confidentiality, integrity, and availability across trust boundaries.
Affected Products
- Dassault Systèmes 3DEXPERIENCE Station Launcher App — Release R2023x
- Dassault Systèmes 3DEXPERIENCE Station Launcher App — Releases R2024x and R2025x
- Dassault Systèmes 3DEXPERIENCE Station Launcher App — Release R2026x
Discovery Timeline
- 2026-07-28 - CVE-2026-11756 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-11756
Vulnerability Analysis
The Station Launcher App deserializes attacker-controlled data without validating the object type or origin. When an application reconstructs objects from a serialized byte stream, a malicious payload can instantiate arbitrary classes and invoke methods available in the runtime classpath. This class of flaw, cataloged as CWE-502, routinely converts into remote code execution when gadget chains are present in the application dependencies.
The advisory indicates the attack traverses a network path and does not require credentials or user interaction. The scope change (S:C) reported by Dassault Systèmes signals that a successful exploit crosses a security boundary, meaning code executes with privileges beyond those of the vulnerable component itself.
Root Cause
The root cause is the acceptance and processing of untrusted serialized objects by the Station Launcher App. The component does not enforce an allow-list of deserializable types, does not use a safe data format such as JSON with strict schemas, and does not cryptographically verify the integrity of inbound payloads before reconstruction.
Attack Vector
An unauthenticated attacker delivers a crafted serialized payload to the Station Launcher App over the network. The application deserializes the payload, triggering a gadget chain that culminates in arbitrary command execution on the host. See the 3DS Security Advisory CVE-2026-11756 for vendor-supplied details on the affected endpoint and payload constraints.
No public proof-of-concept exploit has been observed at publication time. No code sample is reproduced here because no verified exploit code has been released.
Detection Methods for CVE-2026-11756
Indicators of Compromise
- Unexpected child processes spawned by the Station Launcher App service account, particularly shells, script interpreters, or LOLBins.
- Inbound network connections to Station Launcher App listeners from untrusted sources followed by outbound egress to unknown infrastructure.
- New or modified files in the 3DEXPERIENCE installation directories written by the launcher process outside of scheduled updates.
- Serialized-object magic bytes (for example, Java AC ED 00 05) present in HTTP request bodies destined for the launcher endpoint.
Detection Strategies
- Inspect application and web-tier logs for oversized or binary payloads posted to Station Launcher App URIs.
- Alert on process-lineage anomalies where the launcher process spawns command interpreters, curl, wget, powershell.exe, or certutil.exe.
- Correlate authentication-free access to the launcher endpoint with subsequent outbound network activity from the host.
Monitoring Recommendations
- Enable verbose logging on the 3DEXPERIENCE application tier and forward logs to a central analytics platform for retention and query.
- Baseline normal Station Launcher App traffic patterns and alert on deviations in request size, content type, and source geography.
- Monitor for file writes to temporary directories by the launcher service and flag executable content.
How to Mitigate CVE-2026-11756
Immediate Actions Required
- Apply the fix referenced in the 3DS Security Advisory CVE-2026-11756 to all instances running R2023x through R2026x.
- Restrict network reachability of the Station Launcher App to trusted management networks and authenticated VPN clients only.
- Audit recent access logs for the launcher endpoint to identify anomalous requests preceding the patch window.
Patch Information
Dassault Systèmes has published a security advisory for CVE-2026-11756. Consult the 3DS Trust Center advisory for the current list of fixed builds and upgrade guidance covering releases R2023x through R2026x. Customers should authenticate to the 3DS support portal to retrieve the corresponding hotfix or service pack applicable to their release.
Workarounds
- Block external access to the Station Launcher App at the perimeter and internal firewall until patches are deployed.
- Terminate the Station Launcher App service on systems where the component is not required for business operations.
- Enforce network segmentation so that only 3DEXPERIENCE client subnets can reach the launcher listener.
# Example: restrict Station Launcher App exposure with iptables until patched
# Allow only the trusted client subnet 10.20.30.0/24 to reach the service port
iptables -A INPUT -p tcp --dport <launcher-port> -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <launcher-port> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
