Vulnerability · Published Feb 16, 2026 · Assigned by 3DS
CVE-2026-2101Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19
High 8.7
In plain English
A high-severity cross-site scripting in ENOVIAvpm Web Access from Dassault Systèmes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.3%top 78.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dassault Systèmes | ENOVIAvpm Web Access | ENOVIAvpm V1R16 Golden – through ENOVIAvpm V1R16 SP6ENOVIAvpm V1R17 Golden – through ENOVIAvpm V1R17 SP5ENOVIAvpm V1R18 Golden – through ENOVIAvpm V1R18 SP3ENOVIAvpm V1R19 Golden – through ENOVIAvpm V1R19 SP1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N