CVE-2026-7858

Estado: Pendiente de análisisCrítica (9.8)—

A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x could lead to an unauthenticated remote code execution.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.81%
Percentil entre todas las CVEs puntuadas: 56
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %

CWE-502 (deserialización no confiable) sobre aplicación expuesta en red (AV:N, PR:N, UI:N) permite RCE sin autenticación. Vector CVSS crítico (C:H, I:H, A:H) confirma ejecución de código remota.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation Limit Access to Resource Over Network

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

3DS — Teamwork Cloud^AI Catia — Magic Collaboration Studio^AI

CWE

CWE-502

Referencias

https://www.3ds.com/trust-center/security/security-advisories/cve-2026-7858

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-7858",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7858",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-01T13:10:19.818378Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "3DS.Information-Security@3ds.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "3DS.Information-Security@3ds.com",
      "affectedData": [
        {
          "vendor": "Dassault Systèmes",
          "product": "Teamwork Cloud - Standard Edition",
          "versions": [
            {
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2022x Refresh2 HF3"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2024x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2024x Refresh3 HF1"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2026x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2026x Golden HF2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dassault Systèmes",
          "product": "Teamwork Cloud - Business Edition",
          "versions": [
            {
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2022x Refresh2 HF3"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2024x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2024x Refresh3 HF1"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2026x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2026x Golden HF2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dassault Systèmes",
          "product": "Teamwork Cloud - Business Pro Edition",
          "versions": [
            {
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2022x Refresh2 HF3"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2024x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2024x Refresh3 HF1"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2026x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2026x Golden HF2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dassault Systèmes",
          "product": "Teamwork Cloud - Enterprise Edition",
          "versions": [
            {
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2022x Refresh2 HF3"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2024x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2024x Refresh3 HF1"
            },
            {
              "status": "affected",
              "version": "No Magic Release 2026x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "No Magic Release 2026x Golden HF2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Dassault Systèmes",
          "product": "Magic Collaboration Studio",
          "versions": [
            {
              "status": "affected",
              "version": "CATIA Magic Release 2022x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "CATIA Magic Release 2022x Refresh2 HF3"
            },
            {
              "status": "affected",
              "version": "CATIA Magic Release 2024x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "CATIA Magic Release 2024x Refresh3 HF1"
            },
            {
              "status": "affected",
              "version": "CATIA Magic Release 2026x Golden",
              "versionType": "custom",
              "lessThanOrEqual": "CATIA Magic Release 2026x Golden HF2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-01T09:16:20.990",
  "references": [
    {
      "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-7858",
      "source": "3DS.Information-Security@3ds.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3DS.Information-Security@3ds.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x could lead to an unauthenticated remote code execution."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de deserialización de datos no confiables que afecta a Teamwork Cloud desde No Magic Release 2022x hasta No Magic Release 2026x y a Magic Collaboration Studio desde CATIA Magic Release 2022x hasta CATIA Magic Release 2026x podría conducir a una ejecución remota de código no autenticada."
    }
  ],
  "lastModified": "2026-07-22T07:10:00.107",
  "sourceIdentifier": "3DS.Information-Security@3ds.com"
}