CVE-2026-9024: Stored XSS in DELMIA Service Process Engineer Process Experience Studio

Technical summary

CVE-2026-9024 is a stored XSS vulnerability (CWE-79) affecting Process Experience Studio in DELMIA Service Process Engineer Release 3DEXPERIENCE R2024x through R2026x. The vulnerability requires authenticated access (PR:L) and user interaction (UI:R) but impacts multiple users across trust boundaries (S:C), with high confidentiality and integrity impact. The CVSS 3.1 score of 8.7 reflects the ability to compromise user sessions and manipulate application behavior without directly disrupting service availability.

Business impact

Compromised user sessions within DELMIA Service Process Engineer can lead to unauthorized process modifications, data theft, or execution of malicious actions appearing to originate from legitimate users. For organizations relying on DELMIA for manufacturing and service process management, this could result in process integrity violations, regulatory compliance issues if sensitive manufacturing data is exfiltrated, and erosion of audit trail reliability. The stored nature of the vulnerability amplifies risk by affecting multiple users over time rather than requiring individual target interaction.

Affected systems

DELMIA Service Process Engineer is affected across Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x. The vulnerability is specific to the Process Experience Studio component. Organizations running these releases in their production environments are at risk. No patch version information is provided in the current advisory; vendors and users should verify patch availability and applicability against the official vendor security advisory.

Exploitability

Exploitation requires valid user credentials and the ability to submit content (such as process definitions or templates) that persists within Process Experience Studio. An attacker must then manipulate another user into viewing the malicious content. While not trivial, the attack does not require sophisticated techniques—basic XSS injection patterns are often sufficient. The required authentication barrier moderates exposure compared to unauthenticated XSS, but the stored nature and broad user base within typical DELMIA deployments increase practical risk.

Remediation

Organizations should apply security patches from Dassault Systèmes as they become available. Until patching is possible, implement input validation and output encoding controls at the application level, restrict Process Experience Studio access to trusted users, and monitor for suspicious process content submissions. Review stored process definitions and templates for signs of script injection, particularly JavaScript payloads in name fields, descriptions, or custom properties.

Patch guidance

Consult Dassault Systèmes security advisories for patch releases applicable to your specific Release version (R2024x through R2026x). Prioritize patching production instances managing critical manufacturing or service processes. Test patches in non-production environments first, as Process Experience Studio is often deeply integrated with enterprise workflows. Verify that patching does not require data migration or process definition updates before deploying to production.

Detection guidance

Monitor Process Experience Studio audit logs for submissions of unusually large or complex process definitions, particularly those containing script-like syntax in fields that should contain only text or identifiers. Deploy web application firewalls (WAF) rules to detect stored XSS payloads in request bodies targeting DELMIA. Review stored process templates for embedded JavaScript, event handlers (onload, onerror, etc.), or suspicious iframe or script tags. User behavior analytics may flag accounts creating or modifying multiple processes in unusual patterns.

Why prioritize this

The combination of high CVSS score (8.7), stored persistence, cross-user impact (S:C), high confidentiality and integrity risk, and the requirement for only user-level authentication makes this a significant priority for patching. Manufacturing and service engineering environments are high-value targets; compromise of process definitions could cascade into physical world consequences. The vulnerability is not yet in the CISA KEV catalog, suggesting limited public exploitation, but the stored XSS vector is well-understood and likely to attract attention once patches are released.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects: network-accessible attack vector with low complexity, low privilege requirements, and necessary user interaction. The cross-boundary scope (S:C) and high impact to confidentiality and integrity (C:H/I:H) elevate the score. Availability is not impacted (A:N) because the vulnerability does not disrupt service—it hijacks user sessions. The score appropriately weights the authenticated requirement against the broad user impact within a typical organizational DELMIA deployment.

Frequently asked questions