CVE-2026-5120: BIOVIA Workbook Race Condition Vulnerability

CVE-2026-5120 Overview

CVE-2026-5120 is a race condition vulnerability affecting Dassault Systèmes BIOVIA Workbook from Release 2021 through Release 2026. The flaw allows an authenticated user to access unauthorized data belonging to another user by exploiting concurrent operations. The vulnerability is classified under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

BIOVIA Workbook is a scientific research and laboratory notebook application used across pharmaceutical, biotechnology, and chemical research organizations. Data managed by the platform frequently contains proprietary research, intellectual property, and regulated information.

Critical Impact
An authenticated attacker on the network can exploit timing windows in shared resource access to read and modify data belonging to other users of BIOVIA Workbook.

Affected Products

Dassault Systèmes BIOVIA Workbook Release 2021
Dassault Systèmes BIOVIA Workbook Releases 2022 through 2025
Dassault Systèmes BIOVIA Workbook Release 2026

Discovery Timeline

2026-07-01 - CVE-2026-5120 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-5120

Vulnerability Analysis

The vulnerability stems from improper synchronization when BIOVIA Workbook processes concurrent requests that access shared resources. When two or more sessions interact with overlapping data objects at the same time, the application fails to enforce consistent isolation between user contexts.

The attacker requires network access and low-privilege authentication to the application. No user interaction is needed. Successful exploitation compromises confidentiality and integrity of another user's data without affecting service availability.

Because BIOVIA Workbook stores scientific and research records, an attacker exploiting the flaw can read proprietary experimental data or alter records belonging to unrelated researchers. This has downstream implications for data integrity attestations in regulated laboratory environments.

Root Cause

The root cause is a race condition [CWE-362] in code paths that access shared resources without adequate locking or transactional isolation. The window between validating access to a resource and using that resource is not atomic. A second concurrent request can alter the state or user context tied to that resource during the window.

Attack Vector

The attack is network-based and requires an authenticated account on the target BIOVIA Workbook instance. The attacker issues concurrent requests timed to collide with legitimate operations from other users. When the timing succeeds, the attacker's session receives or manipulates data scoped to a different user. Refer to the 3DS Security Advisory CVE-2026-5120 for vendor technical details.

Detection Methods for CVE-2026-5120

Indicators of Compromise

Unexpected access patterns showing a single authenticated session retrieving records owned by unrelated users within short time windows.
Application logs showing high-frequency parallel API calls from one user targeting endpoints tied to shared record objects.
Audit trail inconsistencies where record modifications are attributed to sessions that did not originate the change.

Detection Strategies

Correlate authentication session identifiers with data-object ownership in application logs to surface cross-user access anomalies.
Baseline normal request concurrency per user and alert on bursts of parallel requests to record retrieval or update endpoints.
Review database access logs for transactions where the queried record owner differs from the authenticated principal.

Monitoring Recommendations

Enable verbose application audit logging in BIOVIA Workbook and forward events to a centralized SIEM for correlation.
Monitor for repeated failed integrity checks or unexpected record version increments on notebook entries.
Track user-agent and source IP patterns for authenticated accounts issuing abnormal concurrent workloads.

How to Mitigate CVE-2026-5120

Immediate Actions Required

Review the 3DS Security Advisory CVE-2026-5120 and apply the fixed release identified by Dassault Systèmes.
Inventory all BIOVIA Workbook deployments from Release 2021 through Release 2026 and prioritize patching internet-reachable instances.
Rotate credentials and review recent access logs on affected instances for evidence of exploitation.

Patch Information

Dassault Systèmes has published a security advisory for CVE-2026-5120. Consult the 3DS Trust Center advisory for the specific fixed versions and upgrade guidance for each supported release line.

Workarounds

Restrict network access to BIOVIA Workbook to trusted internal networks and VPN users only, reducing the pool of accounts that can trigger the race.
Enforce least-privilege access so each account has visibility only into projects and notebooks strictly required for its role.
Increase audit log retention and enable real-time alerting on cross-user data access anomalies until patching is complete.

bash

# Example: restrict BIOVIA Workbook access at the network layer
# Allow only the research VLAN to reach the application server
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP