A vulnerability in the serialization mechanisms of Teamwork Cloud and Magic Collaboration Studio allows an unauthenticated attacker to supply crafted data that is deserialized without proper validation. This flaw, classified as CWE‑502, gives attackers the ability to execute arbitrary code with the privileges of the application, potentially leading to full compromise of the system and exposure of sensitive data.

The affected products are Dassault Systèmes Teamwork Cloud – Business, Business Pro, Enterprise, and Standard Editions, and Magic Collaboration Studio. All releases from No Magic Release 2022x through No Magic Release 2026x for Teamwork Cloud and from CATIA Magic Release 2022x through CATIA Magic Release 2026x for Magic Collaboration Studio are impacted. Specific patch versions are not listed in the available data.

The CVSS score of 9.8 indicates critical severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting the exploit is not yet observed in the wild but remains a high theoretical risk. The likely attack vector is the deserialization of untrusted data received via application interfaces, which an attacker can exploit without authentication to run arbitrary code. The impact includes full system compromise, data theft, and potential persistence capabilities if the attacker can execute code with service‑level privileges.