CVE-2026-7858: No Magic Teamwork Cloud RCE Vulnerability

CVE-2026-7858 Overview

CVE-2026-7858 is an insecure deserialization vulnerability [CWE-502] in Dassault Systèmes Teamwork Cloud and Magic Collaboration Studio. The flaw affects Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x. Unauthenticated attackers can submit crafted serialized objects to the affected service over the network. Successful exploitation leads to arbitrary code execution in the context of the server process.

Critical Impact
Remote attackers can execute arbitrary code on collaboration servers without authentication or user interaction, exposing model repositories, credentials, and connected enterprise systems.

Affected Products

Teamwork Cloud — No Magic Release 2022x through No Magic Release 2026x
Magic Collaboration Studio — CATIA Magic Release 2022x through CATIA Magic Release 2026x
Dassault Systèmes No Magic / CATIA Magic product family

Discovery Timeline

2026-06-01 - CVE-2026-7858 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-7858

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled data within Teamwork Cloud and Magic Collaboration Studio. These products provide centralized model repositories for systems engineering teams using MagicDraw and Cameo Systems Modeler. The server exposes network endpoints that accept serialized object streams from clients. The runtime reconstructs these objects without validating their type or content.

When an unauthenticated attacker submits a crafted serialized payload, the deserialization routine instantiates attacker-chosen classes. Gadget chains within the application classpath then trigger method invocations that lead to arbitrary command execution. The attacker gains the privileges of the Teamwork Cloud service account, which typically holds broad access to model data, database connections, and authentication material.

Because the issue is reachable before authentication occurs, network-level exposure of the Teamwork Cloud service is sufficient for exploitation. Internet-facing deployments and flat internal networks both present a viable attack surface.

Root Cause

The root cause is the use of an unsafe deserialization mechanism on untrusted input. The affected components do not enforce class allow-lists, type filtering, or cryptographic integrity checks before reconstructing objects. This pattern matches the CWE-502 weakness class.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a malicious serialized object to the exposed Teamwork Cloud service port. The server deserializes the payload, triggers a gadget chain, and executes operating system commands. See the 3DS Security Advisory CVE-2026-7858 for vendor technical details.

Detection Methods for CVE-2026-7858

Indicators of Compromise

Unexpected child processes spawned by the Teamwork Cloud or Magic Collaboration Studio service account, such as shells, cmd.exe, powershell.exe, or scripting interpreters.
Outbound network connections from the collaboration server to unfamiliar hosts shortly after inbound traffic to the service port.
New files written under the Teamwork Cloud installation directory, temporary directories, or web-accessible paths.
Authentication logs showing service account use from hosts that do not normally interact with the server.

Detection Strategies

Inspect application and JVM logs for deserialization exceptions, ClassNotFoundException entries, or stack traces referencing ObjectInputStream and known gadget classes.
Hunt for process lineage anomalies where the Teamwork Cloud Java process spawns native operating system binaries.
Apply network signatures for Java serialization magic bytes (0xACED0005) on traffic destined for collaboration server ports from untrusted sources.

Monitoring Recommendations

Forward Teamwork Cloud server, host, and network telemetry to a centralized analytics platform for correlation.
Alert on first-seen outbound destinations and on any execution of command interpreters by the service account.
Track EPSS movement for CVE-2026-7858 and prioritize response if exploitation activity emerges.

How to Mitigate CVE-2026-7858

Immediate Actions Required

Restrict network access to Teamwork Cloud and Magic Collaboration Studio so only authorized engineering clients and gateways can reach the service ports.
Remove direct internet exposure and place the service behind a VPN, reverse proxy, or zero-trust access broker that enforces authentication before traffic reaches the application.
Review host and application logs for signs of prior exploitation across the full vulnerability window from Release 2022x onward.

Patch Information

Dassault Systèmes has published a security advisory tracking CVE-2026-7858. Administrators should consult the 3DS Security Advisory CVE-2026-7858 for fixed release identifiers and apply the vendor-supplied updates for both Teamwork Cloud and Magic Collaboration Studio across all affected Release 2022x through 2026x branches.

Workarounds

Place the service behind network controls that block unauthenticated traffic until patches are deployed.
Run the Teamwork Cloud service under a least-privilege account with no interactive logon and no domain administrative rights.
Enable egress filtering on the server to limit outbound connections to known model repository and database destinations.

bash

# Example: restrict inbound access to the Teamwork Cloud service port to a trusted subnet
sudo iptables -A INPUT -p tcp --dport 3579 -s 10.20.30.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3579 -j DROP