CVE-2026-84154 Code injection in GEOVIA Geospatial Data Manager
An attacker can execute arbitrary code on the server via a code injection flaw in GEOVIA Geospatial Data Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84154?
CVE-2026-84154 is a critical code injection vulnerability in Dassault Systèmes GEOVIA Geospatial Data Manager, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
Weakness: CWE-94
Which versions are affected by CVE-2026-84154?
How do I fix CVE-2026-84154?
No fix has been published for CVE-2026-84154 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-84154 being exploited?
There is no known exploitation of CVE-2026-84154 in the wild and no public exploit code.
Sources
Also known as GHSA-4j5g-4952-v4rh.