CVE-2026-16279: CWE-285 Improper Authorization in Dassault Systèmes 3DSwymer

This vulnerability (CWE-285) in 3DSwymer's 3DPassport component allows improper authorization, potentially enabling attackers to access user accounts without proper permissions. It affects versions from 3DEXPERIENCE R2023x through R2026x. The CVSS 3.1 score of 9.3 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation could lead to unauthorized access to user accounts, compromising confidentiality and integrity of affected accounts. Availability is not impacted. The vulnerability is critical due to the potential for significant unauthorized data exposure or manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor Dassault Systèmes advisories for updates and apply patches promptly once available.