CVE-2026-16279

CriticalCVSS 9.3/10Last modified Sep 8, 2026

Description

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-285

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dassault Systèmes	3DSwymer	>= Release 3DEXPERIENCE R2023x Golden, <= Release 3DEXPERIENCE R2023x.FP.CFA.2613; >= Release 3DEXPERIENCE R2024x Golden, <= Release 3DEXPERIENCE R2024x.FP.CFA.2632; >= Release 3DEXPERIENCE R2025x Golden, <= Release 3DEXPERIENCE R2025x.FP.CFA.2628; >= Release 3DEXPERIENCE R2026x Golden, <= Release 3DEXPERIENCE R2026x.FP.CFA.2635

References

https://www.3ds.com/trust-center/security/security-advisories/cve-2026-16279

Timeline

Published: Aug 27, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-16284.6Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which a CVE-2026-162809.8An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs large CVE-2026-162817.1The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI imag CVE-2026-162825.3The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side confi CVE-2026-162838.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Techn CVE-2026-162857.5The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library CVE-2026-162869.8Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade CVE-2026-162877.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo CVE-2026-162894.3The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, a CVE-2026-16294.3Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the u CVE-2026-162905.3The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers CVE-2026-162914.3The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allo