Vulnerability · Published Aug 11, 2026 · Assigned by 3DS
CVE-2026-17061Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026
Critical 10.0
In plain English
A critical-severity unsafe deserialization in SIMULIA Execution Engine from Dassault Systèmes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.8%top 42.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dassault Systèmes | SIMULIA Execution Engine | Release 2023 GoldenRelease 2024 Golden – through Release 2024 FP.CFA.2615Release 2025 Golden – through Release 2025 FP.CFA.2628Release 2026 Golden – through Release 2026 FP.CFA.2624 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H