External risk intelligence

SIMULIA Execution Engine Remote Code Execution via Untrusted Deserialization

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-17061

The SIMULIA Execution Engine is typically used in engineering and simulation environments which are usually restricted to internal networks. While the vulnerability allows for unauthenticated remote code execution, it is not a service typically exposed to the public internet, though it could be reachable in some specific deployment configurations.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SIMULIA Execution Engine, impacting several releases. This issue allows for remote code execution without authentication, meaning an attacker could potentially gain control of affected systems from afar. The main concern is to confirm if this specific software is in use and if it is exposed in a way that could be targeted.

Unauthenticated remote code execution risk.
Affects SIMULIA Execution Engine releases.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the SIMULIA Execution Engine over the network. Because no authentication is required, an unauthenticated remote attacker could trigger the deserialization flaw, potentially leading to unauthorized code execution on the affected system.

No authentication required.
Triggered by crafted network data.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A Deserialization of Untrusted Data vulnerability in SIMULIA Execution Engine could allow an unauthenticated remote attacker to execute arbitrary code. This risk is present when the engine processes untrusted data, potentially leading to a compromise of the affected system. The conditions under which this vulnerability might be exploited are not fully detailed, but the attack vector is network-based, meaning it could be accessible remotely.

System code execution.
Untrusted data processing.
System compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability will likely fall to the platform or infrastructure teams responsible for the SIMULIA Execution Engine, with support from security and potentially application owners if the engine is integrated into specific workflows. The first practical step is to identify all instances of the SIMULIA Execution Engine within the environment, determine their exposure, and confirm accountability for remediation planning and execution.

Platform or infrastructure teams own remediation.
Verify instances and exposure first.
Plan maintenance and coordinate vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SIMULIA Execution Engine?

SIMULIA Execution Engine is a software framework used to distribute and manage computationally intensive simulation and engineering workflows. It acts as the backbone for running complex tasks across networked computing resources, helping organizations process large-scale analysis projects more efficiently.

What does deserialization of untrusted data mean for CVE-2026-17061?

This weakness, categorized as CWE-502, occurs when an application takes data received from an external source and reconstructs it into a complex object without proper validation. In this CVE, the engine blindly trusts this incoming data, which allows a remote attacker to embed malicious instructions that the system then executes.

How is this deserialization flaw triggered?

An attacker triggers the vulnerability by sending a specially crafted stream of data directly to the SIMULIA Execution Engine over the network. It is important to note that the flaw is not triggered by standard, legitimate simulation traffic; it requires the processing of malicious, malformed input designed specifically to exploit how the software handles object reconstruction.

Is my SIMULIA Execution Engine at risk?

According to Halo Surface Signal, this software is typically housed within internal engineering networks, which reduces the likelihood of direct public access. However, because the vulnerability allows for unauthenticated remote code execution, you should evaluate if your specific deployment is reachable from outside your internal perimeter or by unauthorized users on your local network.

What should I do first to address this advisory?

Your first step is to perform an inventory of all systems running the SIMULIA Execution Engine to identify where it is deployed. Once located, work with your infrastructure or platform teams to assess the network reachability of these instances and prepare for maintenance windows to apply necessary vendor-provided updates.

References

www.3ds.com/trust-center/security/security-advisories/cve-2026-17…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.