CVE-2026-9024: Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x

Synopsis

A stored cross-site scripting (XSS) vulnerability affects the Process Experience Studio component in Dassault Systèmes DELMIA Service Process Engineer, covering releases 3DEXPERIENCE R2024x through R2026x. The vulnerability is reachable over the network and requires a low-privilege account; a victim must interact with attacker-controlled content in their browser session before the payload fires. Successful exploitation lets an attacker run arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected DELMIA Service Process Engineer instance over the network (AV:N); no local or physical access is required.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account on the platform; unauthenticated access is not sufficient to inject the stored payload (PR:L).

• Victim interactionRequired

  A logged-in user must open or interact with a page containing the attacker's stored payload before the malicious script executes in their browser session (UI:R).

• Attack complexityDetail

  Exploitation is reliable and requires no special race conditions or environmental prerequisites; the attack succeeds consistently once the payload is stored and the victim loads the affected page (AC:L).

Blast Radius

• An attacker's JavaScript runs in the victim's authenticated browser session, giving access to session tokens and cookies scoped to the 3DEXPERIENCE platform.
• Sensitive data visible to the victim, such as process design records and service engineering documents, can be read and exfiltrated.
• The attacker can perform state-changing actions within the platform on the victim's behalf, including modifying or deleting process configurations.
• Because the scope is changed (S:C in the CVSS vector), the impact can extend beyond the immediate application to other browser-accessible resources in the same origin context.