CVE-2026-17061: SIMULIA Execution Engine RCE Vulnerability

CVE-2026-17061 Overview

CVE-2026-17061 is an unauthenticated remote code execution vulnerability in Dassault Systèmes SIMULIA Execution Engine, affecting Release 2023 through Release 2026. The flaw stems from insecure deserialization of untrusted data [CWE-502]. An unauthenticated attacker with network access can send a crafted serialized object to the service and execute arbitrary code with the privileges of the affected process. The scope-changed CVSS 3.1 rating of 10.0 reflects the ability to impact resources beyond the vulnerable component. SIMULIA Execution Engine is widely deployed in engineering simulation environments, making this a high-value target for attackers seeking initial access to industrial and R&D networks.

Critical Impact
Unauthenticated remote attackers can achieve full remote code execution over the network, compromising confidentiality, integrity, and availability of SIMULIA Execution Engine and adjacent resources.

Affected Products

Dassault Systèmes SIMULIA Execution Engine Release 2023
Dassault Systèmes SIMULIA Execution Engine Releases 2024 and 2025
Dassault Systèmes SIMULIA Execution Engine Release 2026

Discovery Timeline

2026-08-11 - CVE-2026-17061 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17061

Vulnerability Analysis

CVE-2026-17061 is an insecure deserialization vulnerability in the SIMULIA Execution Engine. The affected component accepts serialized objects from network clients and reconstructs them without validating the object type or content. When the deserialization routine processes attacker-controlled data, it instantiates classes and invokes methods that can be chained into arbitrary command execution. Attackers do not need valid credentials, and no user interaction is required. Because the CVSS scope is marked as changed, successful exploitation extends impact to resources managed by other security authorities, such as backend databases, job schedulers, or downstream compute nodes orchestrated by the Execution Engine.

Root Cause

The root cause is a violation of CWE-502: Deserialization of Untrusted Data. The service deserializes objects from network input without a strict allow-list of expected types, without cryptographic integrity verification, and without sandboxing the deserialization context. This permits gadget chains present in the application's classpath to be triggered during object reconstruction, leading to code execution.

Attack Vector

The attack vector is network based with low complexity. An attacker sends a crafted serialized payload to a network-exposed SIMULIA Execution Engine endpoint. No authentication, privileges, or user interaction are required. Because SIMULIA Execution Engine typically orchestrates compute jobs across multiple hosts, a single compromised instance can serve as a pivot into simulation clusters and shared storage.

No verified proof-of-concept code is publicly available. Refer to the 3DS Security Advisory CVE-2026-17061 for vendor-supplied technical details.

Detection Methods for CVE-2026-17061

Indicators of Compromise

Unexpected child processes spawned by SIMULIA Execution Engine service accounts, particularly shells, scripting interpreters, or curl/wget invocations.
Inbound network connections to Execution Engine service ports from unrecognized sources, followed by outbound connections to previously unseen destinations.
Serialized object payloads in application logs containing unusual class references or gadget-chain markers.
New scheduled tasks, cron jobs, or job submissions created without an associated authenticated user session.

Detection Strategies

Monitor for anomalous process lineage where the SIMULIA Execution Engine service process spawns operating-system command interpreters.
Inspect network traffic to Execution Engine listeners for serialized Java or platform-native object headers from untrusted network segments.
Correlate authentication logs with job submission events to identify jobs executed without a preceding successful authentication.

Monitoring Recommendations

Enable verbose application logging on SIMULIA Execution Engine and forward logs to a centralized SIEM for retention and correlation.
Baseline outbound network traffic from Execution Engine hosts and alert on deviations, especially connections to internet destinations.
Track file integrity on Execution Engine binaries, configuration files, and job definition directories.

How to Mitigate CVE-2026-17061

Immediate Actions Required

Apply the vendor-supplied fixes referenced in the 3DS Security Advisory CVE-2026-17061 to all SIMULIA Execution Engine deployments from Release 2023 through Release 2026.
Restrict network access to SIMULIA Execution Engine service ports so that only authorized simulation clients and orchestration hosts can reach them.
Review recent job submissions, process execution logs, and outbound network activity on Execution Engine hosts for signs of prior exploitation.

Patch Information

Dassault Systèmes has published a security advisory for CVE-2026-17061. Consult the 3DS Security Advisory CVE-2026-17061 for the authoritative list of fixed releases, hotfixes, and upgrade paths across affected releases.

Workarounds

Place SIMULIA Execution Engine behind a segmented network zone or VPN, denying direct exposure to untrusted networks and the internet.
Enforce firewall access control lists that restrict inbound traffic to the Execution Engine service to a known list of client IP addresses.
Run the Execution Engine service under a least-privileged account and disable unused features that expose deserialization endpoints where the vendor permits.

bash

# Example: restrict inbound access to SIMULIA Execution Engine using iptables
# Replace <trusted_subnet> and <engine_port> with values from your environment
iptables -A INPUT -p tcp -s <trusted_subnet> --dport <engine_port> -j ACCEPT
iptables -A INPUT -p tcp --dport <engine_port> -j DROP