Critical flaw in DELMIA Apriso manufacturing software under active exploitation
Take action: If you use DELMIA Apriso factory software (any version from 2020 to 2025), make sure it's isolated and accessible only from trusted networks. Then check for security patches from Dassault Systèmes and apply them right away. Attackers are actively exploiting this system.
Learn More
CISA has issued an urgent warning about threat actors actively exploiting a critical-severity vulnerability in DELMIA Apriso factory software developed by French company Dassault Systèmes.
DELMIA Apriso is a widely deployed Manufacturing Operations Management (MOM) and Manufacturing Execution System (MES) software platform designed for manufacturing process management. The system serves as a bridge connecting factory equipment with Enterprise Resource Planning (ERP) systems and is used in multiple industries including aerospace and defense, automotive, high-tech electronics, and industrial equipment sectors.
The vulnerability is tracked as CVE-2025-5086 (CVSS score 9.0) and is a deserialization of untrusted data issue that enables remote code execution (RCE) capabilities. Deserialization flaws occur when untrusted or attacker-controlled data is processed by an application without proper validation, allowing malicious objects to trigger arbitrary code execution on vulnerable systems.
Affected Versions:
- DELMIA Apriso Release 2020 Golden through Release 2020 SP4
- DELMIA Apriso Release 2021 Golden through Release 2021 SP3
- DELMIA Apriso Release 2022 Golden through Release 2022 SP3
- DELMIA Apriso Release 2023 Golden through Release 2023 SP3
- DELMIA Apriso Release 2024 Golden through Release 2024 SP1
- DELMIA Apriso Release 2025 Golden through Release 2025 SP1
The vulnerability was initially publicly disclosed by Dassault Systèmes on June 2, 2025, but the vendor's advisory provided limited technical details beyond confirming the remote code execution potential.
Active exploitation of CVE-2025-5086 was first documented by Johannes Ullrich of the SANS Internet Storm Center on September 3, 2025. Security researchers observed attack traffic originating from IP address 156.244.33.162. The exploitation attempts utilize SOAP-based POST requests targeting the vulnerable endpoint /apriso/WebServices/FlexNetOperationsService.svc/Invoke, delivering malicious payloads through XML-embedded objects leveraging .NET deserialization vulnerabilities.
Organizations operating DELMIA Apriso systems should immediately identify all instances within their networks, assess version status, and implement emergency patching or compensating controls. For environments where immediate patching is not feasible due to production requirements, security teams should implement network isolation controls.
