This vulnerability (CVE-2026-11756) is a CWE-502 deserialization of untrusted data issue in the Station Launcher App component of the 3DEXPERIENCE platform by Dassault Systèmes. It affects versions from Release R2023x through R2026x. Exploitation could lead to unauthenticated remote code execution with complete confidentiality, integrity, and availability impact. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on affected systems, potentially leading to full system compromise. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. This poses a critical risk to organizations using the affected versions of the 3DEXPERIENCE platform's Station Launcher App.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should monitor Dassault Systèmes advisories closely and consider restricting network access to the Station Launcher App until a patch is available.