This vulnerability (CVE-2026-5120) is a CWE-362 race condition in BIOVIA Workbook that impacts versions from Release 2021 through Release 2026. It allows an attacker with low privileges to exploit improper synchronization in concurrent execution, potentially leading to unauthorized data disclosure between users. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. Integrity and confidentiality impacts are high, while availability is not affected. No official patch or remediation guidance has been published by Dassault Systèmes as of the publication date.

Successful exploitation could result in unauthorized disclosure of sensitive data from other users within the BIOVIA Workbook environment. The vulnerability compromises confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor Dassault Systèmes advisories for updates. Until a fix is available, restrict access to trusted users and consider limiting concurrent access scenarios that might trigger the race condition.