CVE-2026-5120: BIOVIA Workbook Race Condition Allows Unauthorized Data Access (CVSS 8.1)

Technical summary

CVE-2026-5120 is a classic race condition (CWE-362) in BIOVIA Workbook's data access layer. The vulnerability emerges from inadequate synchronization between concurrent requests—when two authenticated users perform operations nearly simultaneously, the application may grant one user access to the other's data. The flaw requires network access and valid authentication (PR:L in the CVSS vector), but no user interaction is needed for the attack to succeed. The attack surface is network-wide, and confidentiality impact is rated high; integrity and availability are unaffected.

Business impact

Unauthorized data disclosure in Workbook poses significant compliance and operational risk. If your organization handles regulated data (pharma research, engineering designs, proprietary analyses), a breach could trigger regulatory notifications, customer notification obligations, and reputational harm. The vulnerability is exploitable by any authenticated user—including contractors, partners, or staff with legitimate access—making it a potential insider threat vector. Data exfiltration could occur without audit logs showing unusual data movement, complicating forensics. Affected deployments should assume multi-user environments face cross-user visibility risks immediately.

Affected systems

BIOVIA Workbook Release 2021, 2022, 2023, 2024, 2025, and 2026 are in scope. Verify your installed release version in Workbook's Help > About menu or deployment records. Organizations running any of these versions in multi-user configurations are exposed. Single-user or isolated instances are lower-risk but not immune if users log in and out frequently from shared sessions.

Exploitability

Exploitability is moderate-to-high in real-world deployments. An attacker must possess valid Workbook credentials, limiting the threat to authorized users, insiders, or those with compromised accounts. No public exploit code is known (KEV status: not yet added to CISA's Known Exploited Vulnerabilities catalog), but the flaw is straightforward—timing-based race conditions are well-understood attack patterns. In busy environments with high concurrency (many simultaneous users), exploitation likelihood increases. Remote network access is sufficient; no local access or special privileges are required beyond basic authentication.

Remediation

Dassault Systèmes (vendor of BIOVIA) has not yet published confirmed patch version numbers in public advisories as of this analysis. Contact your BIOVIA support account immediately for patch availability and scheduled release timelines. Interim mitigations include: restricting Workbook access via network segmentation to trusted users only, implementing strict access controls on user credentials, enabling audit logging if available, and monitoring for suspicious concurrent login patterns. Do not delay patching once a vendor-confirmed release is available.

Patch guidance

Monitor the BIOVIA support portal and Dassault Systèmes security advisories for a patched release. When a patch is released, test it thoroughly in a staging environment before production deployment, particularly validating concurrent multi-user access scenarios. Patch priority should be critical given the HIGH CVSS score and cross-user data exposure risk. Verify patch notes explicitly confirm remediation of race condition flaws in data access handling. Create a patching timeline targeting completion within 30 days of vendor release if your environment contains sensitive multi-user data.

Detection guidance

In the absence of a vendor IDS signature, focus on behavioral indicators: monitor audit logs for users accessing data outside their normal workflow patterns, check for simultaneous login sessions from the same user account across multiple IPs, and track database query patterns for rapid-fire requests to other users' records. If Workbook exposes query or access logs, look for timestamps showing near-identical request times from different user sessions hitting the same data object. Collect baseline metrics of concurrent user counts and request latency; spikes in concurrency may signal exploitation attempts. Endpoint detection and response tools should flag unusual process behavior if Workbook is compromised.

Why prioritize this

This vulnerability warrants immediate attention due to the HIGH CVSS score (8.1), broad version range affected (2021–2026), and low authentication barrier (any valid user). The confidentiality impact is complete for exposed data. Although the vulnerability is not yet widely exploited (not in KEV), the simplicity of race condition attacks and the sensitive nature of Workbook data (used in R&D, pharmaceuticals, engineering) mean exploitation is plausible if credentials are compromised or insider threats exist. Prioritize this above lower-severity flaws; treat it at the same level as critical authentication or injection vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: network accessibility (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction needed (UI:N), and high confidentiality impact (C:H). Integrity and availability are not affected, which prevents a critical score. The PR:L requirement (valid credentials) is the key mitigating factor; otherwise, this would be critical. In environments with lax credential hygiene or high insider threat risk, treat this as functionally critical. The score appropriately weights the ease of exploitation against the scope limitation to one authenticated user per attack.

Frequently asked questions