Loading story…
Dassault Systèmes disclosed CVE-2026-10094, a critical path traversal flaw in SOLIDWORKS Visualize that affects versions shipped with SOLIDWORKS Desktop Release 2024 through Release 2026. The vulnerability is rated CVSS 9.8 and is described as remotely exploitable, with successful attacks allowing an attacker to write arbitrary files on the server.
The vendor advisory and vulnerability tracking data indicate the issue could let remote attackers abuse file path handling to place files outside intended directories, creating a serious risk for systems running affected releases. Organizations using SOLIDWORKS Visualize should update to the latest vendor-fixed version, apply available patches, restrict file system permissions, and validate file path inputs where possible.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Dassault Systèmes disclosed a critical path traversal vulnerability, CVE-2026-10094, affecting SOLIDWORKS Visualize in SOLIDWORKS Desktop Release 2024 through Release 2026. The advisory states that successful exploitation could allow a remote attacker to write arbitrary files on the server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical path traversal vulnerability (CVE-2024-48510) has been identified in Rockwell Automation's AADvance-Trusted SIS Workstation, specifically affecting versions 2.00.00 to 2.00.04. The flaw, rooted in the DotNetZip library (v1.16.0 and earlier), could allow a remote attacker to execute arbitrary code if a victim opens a malicious file, potentially compromising safety instrumented system (SIS) applications used in critical manufacturing sectors. The vulnerability is rated high severity, with a CVSS v4 score of 8.6, and exploitation requires user interaction but is considered low complexity and remotely exploitable. Rockwell Automation discovered the issue during internal testing and reported it to CISA, emphasizing their commitment to transparency and product security. The company has released a security advisory confirming the vulnerability, noting that it has been corrected and that no known exploitation has occurred in the wild. Organizations using affected SIS Workstation versions are urged to apply available mitigations to prevent potential remote code execution attacks targeting critical infrastructure environments worldwide.
Jun 29, 2026
A critical relative path traversal vulnerability, identified as CVE-2025-62498, was discovered in *AutomationDirect Productivity Suite* software, specifically affecting versions up to 4.4.1.19. This vulnerability, also known as ZipSlip, allows an attacker who can tamper with a productivity project file to execute arbitrary code on the machine where the project is opened. The flaw is remotely exploitable and has been assigned a CVSS v3.1 base score of 8.8 and a CVSS v4 score of 9.3, indicating high severity. The vulnerability impacts multiple *Productivity* PLC models, including Productivity 3000, 2000, and 1000 series CPUs running affected software versions. Successful exploitation could enable attackers to gain full control over the affected system, potentially leading to information disclosure, unauthorized file access, or further compromise of industrial control environments. The vulnerability was reported to ICS-CERT, and advisories have been published to inform users and administrators of the risk and to recommend mitigation steps. No affected product table was provided in the CVE feed, but CISA's advisory lists specific impacted models and software versions, emphasizing the need for immediate attention from organizations using these products in critical infrastructure environments.
Jul 12, 2026
Dassault Systèmes disclosed **CVE-2026-7858**, a critical deserialization of untrusted data flaw affecting **No Magic Teamwork Cloud** and **Magic Collaboration Studio** that can enable **unauthenticated remote code execution**. The vulnerability carries a **CVSS score of 9.8** and impacts Teamwork Cloud from **No Magic Release 2022x through 2026x** and Magic Collaboration Studio from **CATIA Magic Release 2022x through 2026x**, including Teamwork Cloud **Standard, Business, Business Pro, and Enterprise** editions. Reporting on the disclosure said successful exploitation could give attackers full remote takeover of exposed corporate modeling environments over the network without authentication. Organizations were urged to apply vendor updates immediately and reduce exposure by removing vulnerable servers from the public internet and enforcing network segmentation until remediation is complete.
Jun 29, 2026