CVE-2025-5086
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-5086 is a critical deserialization of untrusted data vulnerability in DELMIA Apriso, a manufacturing execution system (MES) developed by Dassault Systemes used in industrial and manufacturing environments. The vulnerability affects DELMIA Apriso from Release 2020 through Release 2025 and could allow a remote attacker to achieve remote code execution on the affected server. With a CVSS v3.1 base score of 9.0 and a changed scope, successful exploitation of this deserialization vulnerability can compromise not only the Apriso application but also the underlying infrastructure. CISA has added CVE-2025-5086 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 2, 2025, and the EPSS score of 39.19% at the 97th percentile confirms very high exploitation probability for this manufacturing software vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| 3ds | delmia apriso | >= 2020, <= 2025 |
References
- https://www.3ds.com/vulnerability/advisories(Vendor Advisory)
- https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256(Exploit, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-5086 is classified under CWE-502 (Deserialization of Untrusted Data), a weakness where the application deserializes data from an untrusted source without sufficient validation. In DELMIA Apriso, the application processes serialized objects from network input without verifying their integrity or restricting the types of objects that can be instantiated, allowing an attacker to supply malicious serialized data that executes arbitrary code during the deserialization process.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2025-5086 carries a CVSS v3.1 base score of 9.0 (Critical severity) with high attack complexity (AC:H) offset by no authentication requirement (PR:N), no user interaction (UI:N), and a changed scope (S:C). Confidentiality and integrity face high impact because remote code execution grants the attacker the ability to read and modify any data accessible to the DELMIA Apriso application, including manufacturing execution data, production schedules, quality control records, and supply chain information. Availability also faces high impact as the attacker can disrupt manufacturing operations by altering or halting the MES system. The changed scope indicates that compromise of the Apriso application can affect the underlying server, database systems, and potentially connected industrial control systems. The EPSS score of 39.19% at the 97th percentile places this among the top 3% of vulnerabilities by exploitation probability. Manufacturing execution systems are high-value targets because they bridge IT and operational technology (OT) environments, and compromising them can have both data theft and physical production impact.
Exploit Maturity
CVE-2025-5086 demonstrates very high exploit maturity. CISA has confirmed active exploitation by adding it to the KEV catalog. Public exploit attempts have been documented by the SANS Internet Storm Center, which observed active scanning and exploitation attempts targeting DELMIA Apriso installations. The EPSS score of 39.19% at the 97th percentile confirms very high exploitation probability. Deserialization vulnerabilities in enterprise applications are consistently among the most exploited vulnerability classes, as they frequently provide reliable remote code execution with minimal prerequisites. The ransomware association for this CVE is currently classified as unknown. The combination of confirmed active exploitation, public exploit documentation, and the critical role of DELMIA Apriso in manufacturing operations makes immediate remediation essential.
Remediation
-
Apply vendor patches immediately. Dassault Systemes has published guidance in their vulnerability advisories portal. Upgrade DELMIA Apriso to the latest patched release that addresses CVE-2025-5086.
-
Restrict network access to DELMIA Apriso servers. Implement firewall rules and network segmentation to ensure the Apriso application is only accessible from authorized management networks and trusted client systems. Do not expose Apriso interfaces directly to the internet.
-
Implement application-level deserialization controls where possible. If the application or application server supports serialization filters (such as Java serialization filters via JEP 290), configure allowlists to restrict the classes that can be deserialized, preventing exploitation of the deserialization vulnerability.
-
Monitor for exploitation indicators by reviewing application server logs for unusual deserialization errors, unexpected process spawning, or network connections to unknown external hosts originating from the Apriso server. Deploy intrusion detection signatures for known deserialization attack patterns.
-
Assess the manufacturing environment for compromise by checking for unauthorized modifications to production data, unexpected user accounts, or suspicious processes on the Apriso server and connected systems. Given the OT integration of manufacturing execution systems, coordinate with industrial control system security teams to evaluate potential lateral movement into the production environment.
Technical Details
CVE-2025-5086 is a deserialization of untrusted data vulnerability (CWE-502) in Dassault Systemes DELMIA Apriso, affecting releases from 2020 through 2025. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a network-accessible attack that requires no authentication or user interaction but has high complexity, with a changed scope reflecting impact beyond the vulnerable component. The vulnerability exists in DELMIA Apriso's handling of serialized data received from network requests. The application accepts and processes serialized objects without properly validating the data against an allowlist of safe types or verifying its integrity. An attacker can craft a malicious serialized payload containing objects that trigger arbitrary code execution during the deserialization process, a well-known exploitation technique for enterprise applications. The high attack complexity rating reflects the need for the attacker to precisely craft the serialized payload and potentially navigate environmental factors, but the no-authentication requirement and the availability of deserialization exploitation frameworks lower the practical barrier significantly. Successful exploitation results in code execution with the privileges of the Apriso application server process.
Frequently Asked Questions
Is CVE-2025-5086 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-5086 to the KEV catalog. The SANS Internet Storm Center has observed active exploit attempts targeting DELMIA Apriso installations. The EPSS score of 39.19% at the 97th percentile confirms very high exploitation probability.
What products are affected by CVE-2025-5086?
Dassault Systemes DELMIA Apriso from Release 2020 through Release 2025 is affected. This manufacturing execution system is commonly deployed in industrial and manufacturing environments for production management.
How do I fix CVE-2025-5086?
Apply the security patches from Dassault Systemes as described in their vulnerability advisories portal. Additionally, restrict network access to the Apriso server and implement network segmentation to isolate the MES environment.
How severe is CVE-2025-5086?
CVE-2025-5086 is rated Critical with a CVSS v3.1 base score of 9.0. The deserialization vulnerability enables remote code execution with a changed scope, meaning compromise of the Apriso application can affect the underlying server infrastructure and connected manufacturing systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.