Stored XSS in DELMIA Service Process Engineer

A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary script code in user's browser session.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a critical stored cross-site scripting (XSS) flaw in DELMIA Service Process Engineer's Process Experience Studio, affecting multiple releases from R2024x through R2026x. Stored XSS vulnerabilities are particularly dangerous because malicious scripts are permanently embedded in the application's data layer, executing automatically whenever users access affected content—no social engineering required. This impacts organizations using DELMIA for service process engineering and design, potentially compromising user sessions, stealing credentials, exfiltrating sensitive design data, or pivoting to lateral movement within enterprise systems. The CVSS score of 8.7 reflects the high severity of arbitrary code execution within authenticated user contexts.

Casky's 301 matched security skills leverage Claude AI with extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe detection patterns for CWE-79 input validation failures, specifically identifying how unsanitized user inputs persist in the Process Experience Studio database and execute when rendered. The platform maps reconnaissance activities (TA0043) where attackers probe for injectable fields, and initial access techniques (TA0001) where stored payloads execute upon victim interaction. Through extended reasoning, practitioners gain visibility into payload injection points, persistence mechanisms within the application logic, and the browser execution context—enabling them to prioritize patching Release 3DEXPERIENCE R2025x and R2026x instances and implement input validation controls before adversaries weaponize this vulnerability at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9024.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-9024

Casky has 301 skills that investigate the attack patterns behind CVE-2026-9024. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn