Bentley — Vulnerabilities & Security Advisories 209

Bentley Systems provides computer-aided design (CAD) and engineering software primarily used for infrastructure projects such as bridges, roads, and buildings. With 209 recorded Common Vulnerabilities and Exposures (CVEs), the platform has historically suffered from critical flaws including remote code execution, cross-site scripting, and privilege escalation vulnerabilities. These weaknesses often stem from improper input validation and insufficient access controls within its desktop and server components. Notable incidents include arbitrary file read and write capabilities that allow attackers to compromise system integrity or execute malicious code remotely. The software’s complex architecture, involving numerous plugins and integrations, frequently introduces attack surfaces that remain unpatched for extended periods. Security researchers emphasize that default configurations often lack robust authentication mechanisms, leaving enterprise deployments exposed to unauthorized access and data exfiltration without immediate remediation.