CVE-2026-9024: DELMIA Service Process Engineer XSS Flaw

CVE-2026-9024 Overview

CVE-2026-9024 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Process Experience Studio component in Dassault Systèmes DELMIA Service Process Engineer. The flaw spans releases from 3DEXPERIENCE R2024x through 3DEXPERIENCE R2026x. An authenticated attacker with low privileges can inject persistent script payloads that execute in the browser sessions of other users who view the affected content. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored script payloads execute in victim browser sessions with scope change, enabling session hijacking, data theft, and unauthorized actions within the 3DEXPERIENCE platform.

Affected Products

DELMIA Service Process Engineer — Process Experience Studio (Release 3DEXPERIENCE R2024x)
DELMIA Service Process Engineer — Process Experience Studio (Release 3DEXPERIENCE R2025x)
DELMIA Service Process Engineer — Process Experience Studio (Release 3DEXPERIENCE R2026x)

Discovery Timeline

2026-06-01 - CVE-2026-9024 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-9024

Vulnerability Analysis

The vulnerability resides in Process Experience Studio, a design and authoring component of DELMIA Service Process Engineer used to model service processes within the 3DEXPERIENCE platform. An authenticated user can submit input fields that are persisted to the application backend and later rendered to other users without proper output encoding. When a victim loads the affected view, the stored payload executes as JavaScript in the context of the 3DEXPERIENCE web application origin.

The scope change in the CVSS profile indicates that exploitation impacts resources beyond the vulnerable component itself. Successful exploitation can compromise session tokens, exfiltrate process design data, perform actions on behalf of the victim, or pivot to additional 3DEXPERIENCE modules accessible from the user's browser context. Confidentiality and integrity are both at high impact, while availability is not directly affected.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. Process Experience Studio fails to sanitize or contextually encode attacker-controlled values before storing and rendering them in the HTML response. The flaw is a stored variant, meaning the malicious payload persists in the application data store and triggers on every subsequent render to any user who accesses the affected resource.

Attack Vector

Exploitation requires network access to the 3DEXPERIENCE web interface and authenticated access with low privileges sufficient to author or modify Process Experience Studio content. User interaction is required: a victim must navigate to the view containing the stored payload. Once the page renders, the script executes automatically. No specialized tooling is required beyond a standard browser and the ability to submit crafted text into vulnerable input fields. Refer to the 3DS Security Advisory CVE-2026-9024 for vendor-specific technical context.

Detection Methods for CVE-2026-9024

Indicators of Compromise

Process Experience Studio records containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URI schemes in user-editable fields.
Unexpected outbound browser requests from authenticated 3DEXPERIENCE sessions to external domains shortly after loading Process Experience Studio views.
Anomalous 3DEXPERIENCE session activity, including session token reuse from unfamiliar IP addresses or rapid privileged actions following a victim login.

Detection Strategies

Inspect application logs and database content for stored fields containing HTML or JavaScript syntax in Process Experience Studio objects.
Deploy a Content Security Policy (CSP) report-only header to identify script execution that violates expected origins and inline-script restrictions.
Correlate web proxy logs with 3DEXPERIENCE authentication events to flag sessions issuing requests to attacker-controlled domains.

Monitoring Recommendations

Enable verbose audit logging on Process Experience Studio create and update operations, capturing the authoring user, timestamp, and submitted payload.
Forward 3DEXPERIENCE web server, application, and browser CSP violation logs to a centralized SIEM for correlation and retention.
Alert on browser sessions originating from 3DEXPERIENCE hosts that contact newly registered or low-reputation external domains.

How to Mitigate CVE-2026-9024

Immediate Actions Required

Apply the security fix referenced in the 3DS Security Advisory CVE-2026-9024 for each affected release.
Audit existing Process Experience Studio records for previously stored payloads and remove or sanitize any embedded HTML or script content.
Restrict authoring permissions in Process Experience Studio to the minimum required user population until patches are deployed.
Force password and session token rotation for accounts that interacted with potentially compromised Process Experience Studio content.

Patch Information

Dassault Systèmes has published a security advisory for CVE-2026-9024 covering DELMIA Service Process Engineer releases 3DEXPERIENCE R2024x, R2025x, and R2026x. Customers should consult the vendor advisory for the specific FixPack, HotFix, or service release applicable to their deployed version and apply it through the standard 3DEXPERIENCE update process.

Workarounds

Enforce a strict Content Security Policy on the 3DEXPERIENCE web tier to block inline scripts and unauthorized script sources.
Place a web application firewall (WAF) in front of the 3DEXPERIENCE platform with rules that block HTML and JavaScript syntax in Process Experience Studio request parameters.
Limit network exposure of the 3DEXPERIENCE web interface to trusted corporate networks and VPN users only.

bash

# Example CSP header for the 3DEXPERIENCE web tier (adjust origins to your environment)
Content-Security-Policy: default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report