CVE-2026-7858 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-7858 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-7858 is a critical unauthenticated remote code execution vulnerability in Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x. The issue is a deserialization of untrusted data flaw, which means an attacker may be able to send a crafted request and execute code on the server without logging in.

Even though there is no current KEV listing and no known exploitation in the wild, the severity is CRITICAL (CVSS 9.8). For solo developers and small teams, this is a high-priority patch-and-contain event: if the affected service is internet-facing or reachable from a shared internal network, treat it as exposed until proven otherwise.

Immediate Action

  • Isolate the service now: remove public exposure, restrict access to trusted IPs/VPN only, and block inbound traffic at the firewall or load balancer.
  • Patch to a vendor-fixed release as soon as it is available. If the vendor advisory lists a safe build, upgrade immediately; if not, monitor the advisory page and apply the first fixed version. Vendor advisory / release notes
  • Disable or remove the vulnerable component if you do not need Teamwork Cloud or Magic Collaboration Studio right now.
  • Take a backup/snapshot before upgrading, then test the upgrade in a staging copy if you have one.
  • Assume possible compromise if the service was exposed: review logs, rotate credentials, and inspect the host for unexpected processes, new users, or outbound connections.
  • Rollback only if the patch breaks production, and only after isolating the system. Do not roll back to a known-vulnerable build on an internet-facing host.

Affected Versions

  • Teamwork Cloud / No Magic Release 2022x through No Magic Release 2026x are vulnerable.
  • Magic Collaboration Studio / CATIA Magic Release 2022x through CATIA Magic Release 2026x are vulnerable.
  • Safe versions: TODO_FIXED_VERSION_OR_LATER and later, per vendor advisory.
  • If you cannot confirm a fixed build: treat all listed 2022x–2026x releases as vulnerable and isolate the service until you can verify a patched version.

Resolution Guide

This issue is product-specific, so there is no npm/pip/Maven package to upgrade directly. Use the vendor installer or container image that contains the fixed release.

# Generic Linux service stop before patching
sudo systemctl stop teamwork-cloud || true
sudo systemctl stop magic-collaboration-studio || true

# Backup application data and config
sudo tar -czf /root/twc-backup-$(date +%F).tgz /opt/teamwork-cloud /etc/teamwork-cloud 2>/dev/null || true
sudo tar -czf /root/mcs-backup-$(date +%F).tgz /opt/magic-collaboration-studio /etc/magic-collaboration-studio 2>/dev/null || true

# After installing the vendor-fixed release, restart
sudo systemctl start teamwork-cloud || true
sudo systemctl start magic-collaboration-studio || true

Docker/container guidance: pin to a known fixed tag once the vendor publishes it. Avoid latest.

# Example only — replace with the vendor's fixed tag
docker pull vendor/teamwork-cloud:TODO_FIXED_TAG
docker run -d --name teamwork-cloud \
  --restart unless-stopped \
  -p 127.0.0.1:8080:8080 \
  vendor/teamwork-cloud:TODO_FIXED_TAG

Hardening examples:

# Put the service behind a reverse proxy and allow only trusted sources
# Example firewall rule
sudo ufw deny 8080/tcp
sudo ufw allow from 10.0.0.0/8 to any port 8080 proto tcp

# If supported, disable remote administration or deserialization-based import features
# TODO: set vendor-specific feature flag or config key here
# Example placeholder:
# deserialization.enabled=false

Code fix example: if your integration code deserializes data from this service, reject untrusted input and use a safe format.

// BAD: do not deserialize untrusted bytes
// Object obj = deserialize(requestBody);

// BETTER: validate source and use a safe parser
if (!isTrustedSource(request.getRemoteAddr())) {
    throw new SecurityException("Untrusted source");
}
// Parse only a strict schema, not arbitrary objects
MyDto dto = objectMapper.readValue(requestBody, MyDto.class);

Detection & Verification

Check installed versions: confirm whether you are on any 2022x–2026x release.

# Linux package/service inventory
systemctl status teamwork-cloud 2>/dev/null
systemctl status magic-collaboration-studio 2>/dev/null

# Search installed files for version strings
grep -RIn "2022x\|2023x\|2024x\|2025x\|2026x" /opt /etc 2>/dev/null | head -50

Check container images:

docker images | grep -Ei 'teamwork|magic|catia|nomagic'
docker inspect vendor/teamwork-cloud:TODO_TAG --format '{{.RepoTags}} {{.Id}}'

Check for suspicious activity: look for unexpected outbound connections, new child processes under the service account, and recent web requests to deserialization-related endpoints.

# Recent logs
journalctl -u teamwork-cloud --since "7 days ago" | tail -200
journalctl -u magic-collaboration-studio --since "7 days ago" | tail -200

# Suspicious processes and network listeners
ps auxf
ss -plant

Verify the fix: after upgrading, re-run version checks and confirm the build matches the vendor’s fixed release. If the vendor publishes a checksum or advisory hash, compare it before deploying.

# Confirm service is running the new version
systemctl status teamwork-cloud
# or
docker exec teamwork-cloud sh -lc 'cat /opt/app/version.txt 2>/dev/null || true'

Risk and Impact

If exploited, this flaw could let an attacker run arbitrary code as the application user, steal project data, pivot deeper into the network, or plant persistence on the host. For small teams, the blast radius can include source code, model repositories, credentials, and any systems reachable from the compromised server.

Because the bug is unauthenticated and critical, exposure on the public internet is especially dangerous. Even internal-only deployments should be treated carefully if multiple users, contractors, or CI systems can reach the service.

Keep reading