# CVE-2026-84154: Dassault Systèmes GEOVIA Geospatial Data Manager code injection

Source: https://junglewise.ai/threats/cve-2026-84154-a-code-injection-vulnerability-affecting-geovia-geospatial-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-84154 · Severity: critical · CVSS 9.9 · Published 2026-09-29

GEOVIA Geospatial Data Manager is enterprise geospatial software used for managing and analyzing location-based data for urban planning and infrastructure projects. A code injection vulnerability allows attackers to execute arbitrary code on affected servers, potentially leading to complete system compromise, data theft, or service disruption. The vulnerability affects multiple GEOVIA products across Release 3DEXPERIENCE R2024x through R2026x.

Vendors: [Dassault SystèMes](https://junglewise.ai/threats/vendors/dassault-syst-mes).

## Quick answers

**Is CVE-2026-84154 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84154 being exploited in the wild.

**How severe is CVE-2026-84154?** Critical severity, with a CVSS score of 9.9, published 29 September 2026.

**Which products and versions are affected?** Dassault SystèMes City Planner for Education Release 3DEXPERIENCE R2024x through R2026x; Dassault SystèMes Geospatial Data Engineer Release 3DEXPERIENCE R2024x through R2026x; Dassault SystèMes Geospatial Data Manager Release 3DEXPERIENCE R2024x through R2026x; Dassault SystèMes Geospatial Designer Release 3DEXPERIENCE R2024x through R2026x; and 3 more.

**Is there a fix for CVE-2026-84154?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84154 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84154?** Check whether you run Dassault SystèMes City Planner for Education, Dassault SystèMes Geospatial Data Engineer, Dassault SystèMes Geospatial Data Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability in GEOVIA Geospatial Data Manager and related products allows arbitrary code execution on the server. The vulnerability affects the GEOVIA product suite within the 3DEXPERIENCE platform from R2024x through R2026x releases. Attack preconditions and specific injection vectors are not detailed in the advisory, though the ability to execute arbitrary code on the server represents full system compromise.

## Affected products

- Dassault Systèmes Geospatial Data Manager Release 3DEXPERIENCE R2024x through R2026x
- Dassault Systèmes Geospatial Data Engineer Release 3DEXPERIENCE R2024x through R2026x
- Dassault Systèmes Geospatial Designer Release 3DEXPERIENCE R2024x through R2026x
- Dassault Systèmes Geospatial Viewer Release 3DEXPERIENCE R2024x through R2026x
- Dassault Systèmes Geospatial Index Release 3DEXPERIENCE R2024x through R2026x
- Dassault Systèmes Geospatial Small Index Release 3DEXPERIENCE R2024x through R2026x
- Dassault Systèmes City Planner for Education Release 3DEXPERIENCE R2024x through R2026x

## Timeline

- 2026-09-29: disclosed

## References

- [https://www.3ds.com/trust-center/security/security-advisories/cve-2026-84154](https://www.3ds.com/trust-center/security/security-advisories/cve-2026-84154)