CVE-2025-5086

9.0

CRITICAL CVSS 3.1

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability - [Actively Exploited]

Description

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

INFO

Published Date :

June 2, 2025, 6:15 p.m.

Last Modified :

Oct. 29, 2025, 1:50 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Oct 02, 2025

Alert Date: Sep 11, 2025 | 50 days ago

Description :

Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-5086 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5086

Affected Products

The following products are affected by CVE-2025-5086 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	3ds	delmia_apriso

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Update DELMIA Apriso to a patched version to prevent remote code execution.

Update DELMIA Apriso to a version after Release 2025.
Apply vendor patches when available.
Validate the integrity of deserialized data.

Public PoC/Exploit Available at Github

CVE-2025-5086 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-5086.

URL	Resource
https://www.3ds.com/vulnerability/advisories	Vendor Advisory
https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256	Exploit Third Party Advisory Technical Description
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-5086 is associated with the following CWEs:

CWE-502: Deserialization of Untrusted Data

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-5086 weaknesses.

CAPEC-586: Object Injection Object Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

hsvhora/research_blogs

Links of research blogs published by me.

Updated: 3 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 16, 2025, 9:30 a.m. This repo has been linked 22 different CVEs too.

opendr-io/causality

A repo for output of an intrusion prediction project

Jupyter Notebook Python Standard ML

Updated: 2 days, 2 hours ago

10 stars 1 fork 1 watcher

Born at : Jan. 4, 2025, 1:44 a.m. This repo has been linked 68 different CVEs too.

Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 weeks, 6 days ago

588 stars 42 fork 42 watcher

Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1290 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-5086 vulnerability anywhere in the article.

The Hacker News

Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack

Oct 29, 2025Ravie LakshmananVulnerability / Malware Threat actors are actively exploiting multiple security flaws impacting Dassault Systèmes DELMIA Apriso and XWiki, according to alerts issued by t ...

Published Date: Oct 29, 2025 (1 day, 16 hours ago)

Daily CyberSecurity

CISA KEV Alert: Critical DELMIA Apriso Flaws Under Active Exploitation Allow RCE and Privileged Access

The Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Dassault Systèmes DELMIA Apriso vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, following confi ...

Published Date: Oct 29, 2025 (1 day, 20 hours ago)

The Cyber Express

CISA Warns that DELMIA Apriso Vulnerabilities Are Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two DELMIA Apriso vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Today’s addition of CVE-2025-6204 and ...

Published Date: Oct 28, 2025 (2 days, 3 hours ago)

BleepingComputer

CISA warns of two more actively exploited Dassault vulnerabilities

The Cybersecurity & Infrastructure Security Agency (CISA) warned today that attackers are actively exploiting two vulnerabilities in Dassault Systèmes' DELMIA Apriso, a manufacturing operations manage ...

Published Date: Oct 28, 2025 (2 days, 5 hours ago)

The Cyber Express

22 Vulnerabilities Under Attack – And Another That Could Be

Cyble researchers detailed 22 vulnerabilities under active attack in a blog post today – and nine of them aren’t in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Twelve of the vulnerabilities ...

Published Date: Sep 23, 2025 (1 month, 1 week ago)

The Cyber Express

CVE-2025-58434: Critical FlowiseAI Flaw Enables Full Account Takeover

A severe security vulnerability has been discovered in FlowiseAI, an open-source AI workflow automation tool, exposing users to the risk of complete account compromise. Tracked as CVE-2025-58434, this ...

Published Date: Sep 15, 2025 (1 month, 2 weeks ago)

The Cyber Express

CISA Warns of Attacks on DELMIA Manufacturing Software Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a manufacturing operations management software vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, a rare add ...