CVE-2026-7858: Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x

Synopsis

A deserialization of untrusted data vulnerability affects Teamwork Cloud (No Magic Release 2022x through 2026x) and Magic Collaboration Studio (CATIA Magic Release 2022x through 2026x) from Dassault Systemes. The vulnerability is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable from any network position that can reach the service. Successful exploitation grants an attacker full remote code execution on the affected host. No fix versions have been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available the moment Dassault Systemes releases a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send malicious serialized data from any network-accessible position without requiring LAN or physical proximity.

• AuthenticationNot required

  No credentials or session token of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need to social-engineer any user; exploitation is fully server-side with no required action from a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no race conditions, memory-layout dependencies, or other environmental factors required.

Blast Radius

• An attacker executes arbitrary code as the process user on the host running Teamwork Cloud or Magic Collaboration Studio.
• All data accessible to that process, including model files, collaboration artifacts, and stored credentials, is readable by the attacker.
• The attacker can write or delete files, modify persisted model data, and alter application state on the compromised host.
• The service can be crashed or made unavailable, disrupting collaborative engineering workflows that depend on it.