[ CVE-2026-84154 · Published 29 Sep 2026 ]

Vulnerability in Dassault Systèmes GEOVIA Geospatial Data Manager

CVSS 9.9 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

Critical severity: CVSS 9.9

[ Description ]Official description

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

www.3ds.com/trust-center/security/security-advisories/cve-2026-84154

[ Facts ]Key facts

CVE: CVE-2026-84154
EUVD: EUVD-2026-88650
Published: 29 Sep 2026, 08:17 UTC
Updated: 30 Sep 2026, 19:57 UTC
NVD status: Deferred
CVSS 3.1: 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Scored by 3DS.Information-Security@3ds.com
EPSS: 0.36% chance of exploitation in 30 days · higher than 28% of CVEs
CISA SSVC: Exploitation: none · Automatable: no · Impact: total
Weakness: CWE-94

[ Affected ]Affected products

Dassault Systèmes GEOVIA Geospatial Data ManagerRelease 3DEXPERIENCE R2024x Golden – ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2632, Release 3DEXPERIENCE R2025x Golden – ≤ Release 3DEXPERIENCE R2025x.FP.CFA.2637, Release 3DEXPERIENCE R2026x Golden – ≤ Release 3DEXPERIENCE R2026x.FP.CFA.2635