CVE-2026-84154

CriticalCVSS 9.9/10Last modified Sep 30, 2026

Description

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Dassault Systèmes	GEOVIA Geospatial Data Manager	>= Release 3DEXPERIENCE R2024x Golden, <= Release 3DEXPERIENCE R2024x.FP.CFA.2632; >= Release 3DEXPERIENCE R2025x Golden, <= Release 3DEXPERIENCE R2025x.FP.CFA.2637; >= Release 3DEXPERIENCE R2026x Golden, <= Release 3DEXPERIENCE R2026x.FP.CFA.2635

References

https://www.3ds.com/trust-center/security/security-advisories/cve-2026-84154

Timeline

Published: Sep 29, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-841555.3CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the CVE-2026-84168.8Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). CVE-2026-841614.9When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's CVE-2026-841640.0The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message,CVE-2026-841658.7A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerab CVE-2026-841664.3The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing a CVE-2026-841674.3The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authent CVE-2026-841685.3The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to CVE-2026-841695.3The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the o CVE-2026-84178.8Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. Th CVE-2026-841708.3Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploa CVE-2026-841719.8The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a p