CVE-2026-16279

CVE-2026-16279 is an improper authorization flaw (CWE-285) in 3DPassport, Dassault Systemes' identity/login component delivered through 3DSwymer, affecting 3DEXPERIENCE releases R2023x through R2026x. The flaw is reachable over the network without prior privileges, but the CVSS vector (UI:R) indicates some form of user interaction is required to trigger it, and the scope-changed score suggests the authorization failure crosses a security boundary. A successful attacker can gain access to some user accounts, with high impact on confidentiality and integrity and no availability impact. Organizations running 3DPassport/3DSwymer within any 3DEXPERIENCE release from R2023x through R2026x are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only about a 0.3% chance of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Determine which 3DEXPERIENCE release (R2023x through R2026x) your on-premises or cloud tenant runs and whether 3DPassport/3DSwymer is deployed, then apply Dassault Systemes' official fix for this advisory as soon as it is available (no fixed version is listed in the current data). Until patched, restrict network access to 3DPassport login endpoints and review authentication logs for signs of unauthorized account access.