CVE Alert: CVE-2025-5086 – Dassault Systèmes – DELMIA Apriso

Risk verdict

Critical risk with confirmed active exploitation; treat as priority 1 due to remote code execution potential.

Why this matters

Deserialising untrusted data can give an attacker full remote control over the host, enabling deployment of malware, data exfiltration, or movement across the network. In manufacturing environments, this could disrupt production lines, impact supply chain timelines, and expose sensitive process data.

Most likely attack path

Attacker reachable over the network with no privileges or user interaction required; high complexity but effectively unauthenticated. If successful, scope is changed, enabling access beyond the initial process and compromising confidentiality, integrity and availability across connected systems.

Who is most exposed

Typically in on‑premise DELMIA Apriso deployments within manufacturing/OT ecosystems, where production systems are exposed to internal networks or remote admin interfaces. Environments with limited network segmentation or firewall constraints are particularly at risk.

Detection ideas

• Monitor for deserialization payload patterns and anomalous serialized objects hitting Apriso services.
• Look for unusual process launches or remote command execution attempts from Apriso endpoints.
• Detect anomalous external connections or scanners targeting Apriso web/services.
• Inspect logs for unexpected failures or crashes indicative of exploitation attempts.

Mitigation and prioritisation

• Apply vendor patch/upgrade to a fixed release beyond SP1; implement patch window as priority.
• Enforce network segmentation around Apriso endpoints; restrict inbound/outbound to trusted hosts only.
• Enable WAF/IPS rules and monitor for suspicious deserialization activity.
• Disable or harden deserialization pathways where feasible; enforce strict input validation.
• Change-management note: coordinate downtime for upgrade; verify backouts and rollback plans. If exploitation remains active or KEV is confirmed, sustain priority 1 monitoring and response.