Is CVE-2026-5120 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5120 being exploited in the wild.

How severe is CVE-2026-5120?

High severity, with a CVSS score of 8.1, published 1 July 2026.

Which products and versions are affected?

Dassault SystèMes BIOVIA Workbook Release 2021 through Release 2026.

Is there a fix for CVE-2026-5120?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5120 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5120?

Check whether you run Dassault SystèMes BIOVIA Workbook at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5120: Dassault Systèmes BIOVIA Workbook race condition

CVE-2026-5120 · Severity: high · CVSS 8.1 · Published 2026-07-01

BIOVIA Workbook, a collaborative scientific electronic laboratory notebook, is affected by a security flaw that could allow one user to access another user's private data. This occurs due to a timing issue in how the software handles simultaneous requests, potentially leading to unauthorized data exposure or modification. Organizations using this software for research and development should ensure they are running the latest patched versions to protect sensitive intellectual property.

Vendors: Dassault SystèMes.

Quick answers

Is CVE-2026-5120 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5120 being exploited in the wild.
How severe is CVE-2026-5120?: High severity, with a CVSS score of 8.1, published 1 July 2026.
Which products and versions are affected?: Dassault SystèMes BIOVIA Workbook Release 2021 through Release 2026.
Is there a fix for CVE-2026-5120?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5120 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5120?: Check whether you run Dassault SystèMes BIOVIA Workbook at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition (CWE-362) exists in BIOVIA Workbook due to improper synchronization during concurrent execution using shared resources. The vulnerability affects releases from 2021 through 2026. An authenticated attacker can exploit this flaw over the network by sending specifically timed requests to the application. Successful exploitation allows the attacker to bypass intended access controls and view or manipulate data belonging to other users. The CVSS 3.1 score is 8.1, reflecting high impact on confidentiality and integrity with low attack complexity, though it requires basic user privileges.

Affected products

Dassault Systèmes BIOVIA Workbook Release 2021 through Release 2026

Timeline

2026-07-01: advisory: Initial advisory published by Dassault Systèmes and NVD.

References

https://www.3ds.com/trust-center/security/security-advisories/cve-2026-5120

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.