Dassault Systèmes DELMIA Apriso Untrusted Data Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2025-5086) Urgent Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTDassault Systèmes DELMIA Apriso from Release 2020 through Release 2025.
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with system privileges via specially crafted serialized payloads.
Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately download and apply the latest security hotfixes and patches from the official Dassault Systèmes Support Portal.
2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the DELMIA Apriso portal and API endpoints. Implement strict IP whitelisting on your firewall or IIS web server.
# Restrict IIS access to trusted internal subnets only (e.g., 10.0.0.0/8) via PowerShell
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name 'allowUnlisted' -Value $false -PSPath 'IIS:\sites\Default Web Site'
Add-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name '.' -Value @{ipAddress='10.0.0.0';subnetMask='255.0.0.0';allowed='true'} -PSPath 'IIS:\sites\Default Web Site'3. Log Audit & IoC Verification Commands
Audit IIS logs and system processes to detect potential exploitation attempts or unauthorized command execution.
# Scan IIS logs for suspicious deserialization-related keywords or payloads
Get-ChildItem -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' |
Select-String -Pattern 'POST' |
Select-String -Pattern '(?i)(ysoserial|microsoft.workflow.compiler|activitysurrogateselector)'
# Check for anomalous child processes spawned by Apriso services
Get-CimInstance Win32_Process | Where-Object {
$_.ParentProcessId -in (Get-Process -Name '*apriso*' -ErrorAction SilentlyContinue).Id
} | Select-Object ProcessId, Name, CommandLine, CreationDateBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-5086) is an untrusted data deserialization flaw (CWE-502) residing in Dassault Systèmes DELMIA Apriso, a prominent Manufacturing Execution System (MES). The root cause stems from the application deserializing untrusted object data from external sources without proper validation, allowing attackers to manipulate the execution flow.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a malicious serialized object payload to an exposed DELMIA Apriso endpoint. Upon receiving the payload, the application's deserialization engine processes the data, triggering a gadget chain that executes arbitrary system commands. This vulnerability requires no authentication (PR:N) and no user interaction (UI:N). It is currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
3. Infrastructure & Business Impact
Since DELMIA Apriso is widely deployed in global manufacturing and supply chain environments, a successful compromise could lead to catastrophic consequences. Attackers could gain full control over production systems, steal proprietary manufacturing recipes, disrupt operations, or deploy ransomware across the enterprise network.
Official Vendor Advisories & References
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Frequently Asked SecOps Questions (CVE-2025-5086)
FAQQ1. How critical is CVE-2025-5086 and is it actively exploited in the wild?
CVE-2025-5086 is rated CVSS 9.0 (CRITICAL) with a 30-day EPSS exploitation probability of 97.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-5086?
Primary impacted vendors include dassault systemes across delmia apriso. Scope summary: Dassault Systèmes DELMIA Apriso Release 2020, 2021, 2022, 2023, 2024, and 2025
Q3. What temporary mitigations or workarounds exist for CVE-2025-5086 before patching?
[Mitigation] Immediately apply the official vendor security patches, restrict external network exposure, and perform compromise assessment using IoC logs. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-5086
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (dassault systemes)
View Category →JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
PTC Windchill and FlexPLM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-12569)
[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.