# CVE-2026-7858: Dassault Systèmes Teamwork Cloud deserialization RCE

Source: https://junglewise.ai/threats/cve-2026-7858-dassault-systemes-teamwork-cloud-deserialization-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-7858 · Severity: critical · CVSS 9.8 · Published 2026-06-01

Dassault Systèmes Teamwork Cloud and Magic Collaboration Studio, which are used for collaborative model-based systems engineering and design, contain a critical security flaw. An unauthorized attacker can remotely execute malicious code on the server without needing any login credentials. This could lead to a total compromise of the server, including the theft of sensitive engineering designs, data destruction, or a complete shutdown of collaborative operations.

Vendors: [Dassault SystèMes](https://junglewise.ai/threats/vendors/dassault-syst-mes).

## Quick answers

**Is CVE-2026-7858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7858 being exploited in the wild.

**How severe is CVE-2026-7858?** Critical severity, with a CVSS score of 9.8, published 1 June 2026.

**Which products and versions are affected?** Dassault SystèMes Magic Collaboration Studio CATIA Magic Release 2022x through CATIA Magic Release 2026x; Dassault SystèMes Teamwork Cloud No Magic Release 2022x through No Magic Release 2026x.

**Is there a fix for CVE-2026-7858?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7858 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7858?** Check whether you run Dassault SystèMes Magic Collaboration Studio or Dassault SystèMes Teamwork Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Deserialization of Untrusted Data vulnerability (CWE-502) exists in Teamwork Cloud and Magic Collaboration Studio. The flaw allows an unauthenticated attacker to send specially crafted serialized objects over the network, which the application then processes without sufficient validation. Successful exploitation leads to remote code execution (RCE) with the privileges of the application service. The vulnerability affects No Magic Release 2022x through 2026x and CATIA Magic Release 2022x through 2026x. Users are advised to consult the Dassault Systèmes trust center for remediation information.

## Affected products

- Dassault Systèmes Teamwork Cloud (Standard, Business, Business Pro, Enterprise Editions) No Magic Release 2022x through No Magic Release 2026x
- Dassault Systèmes (CATIA Magic) Magic Collaboration Studio CATIA Magic Release 2022x through CATIA Magic Release 2026x

## Timeline

- 2026-06-01: advisory: Initial advisory published by Dassault Systèmes and NVD

## References

- [https://www.3ds.com/trust-center/security/security-advisories/cve-2026-7858](https://www.3ds.com/trust-center/security/security-advisories/cve-2026-7858)