CVE-2025-5086: Dassault DELMIA Apriso RCE (KEV)

CVE-2025-5086 is a deserialization-of-untrusted-data vulnerability in Dassault Systemes DELMIA Apriso, a manufacturing execution/operations management (MES) platform used to run and connect factory-floor production processes to enterprise systems, that lets a remote attacker send crafted data to achieve remote code execution; CISA added it to the Known Exploited Vulnerabilities catalog after confirming active, in-the-wild scanning and exploitation attempts.

CVE-2025-5086 is a deserialization of untrusted data vulnerability (CWE-502) affecting Dassault Systemes DELMIA Apriso Release 2020 through Release 2025. DELMIA Apriso is manufacturing operations management (MES) software that factories use to run production processes and connect the shop floor to enterprise resource planning systems, so a remote-code-execution flaw in it reaches directly into operational technology environments (NVD).

NVD lists this CVE as fully analyzed (status "Analyzed"), recording Dassault's own CVSS v3.1 submission of 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable with high attack complexity but no privileges or user interaction required, and complete compromise of confidentiality, integrity and availability once exploited (NVD).

CISA added CVE-2025-5086 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-09-11, with a required-action due date of 2025-10-02, directing agencies to apply vendor mitigations, follow BOD 22-01 guidance for any cloud-hosted instances, or discontinue use of the product if mitigations are unavailable (CISA KEV).

The SANS Internet Storm Center documented live exploitation attempts against the vulnerable WebServices/FlexNetOperationsService endpoint, with scans delivering a crafted SOAP payload that decodes to a GZIP-compressed Windows executable (SANS ISC — Exploit Attempts for Dassault DELMIA Apriso CVE-2025-5086).

Dassault Systemes' own vulnerability advisories page lists the fix as upgrading to a DELMIA Apriso release after 2025 that validates deserialized data before processing it (Dassault Systemes Vulnerability Advisories).

As of 2026-10-22, FIRST scores the probability of exploitation at 0.9692 (99.89th percentile) — among the highest EPSS scores possible, consistent with a KEV-listed, actively-scanned remote code execution flaw in internet-reachable manufacturing software (FIRST EPSS).

Any organization running DELMIA Apriso should upgrade past Release 2025 immediately, treat any internet-exposed instance as likely already probed given the documented scanning activity, and review logs for the SOAP-based exploitation pattern SANS published.

• Deserialization of untrusted data (CWE-502) in DELMIA Apriso Release 2020 through 2025 allows remote code execution. — NVD
• CVSS v3.1 base score 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, Dassault-submitted, status Analyzed. — NVD
• Added to the CISA KEV catalog on 2025-09-11, required-action due date 2025-10-02. — CISA KEV
• Live exploitation attempts observed against the WebServices/FlexNetOperationsService endpoint, delivering a GZIP-compressed Windows executable via SOAP payload. — SANS ISC
• EPSS score is 0.9692 (99.89th percentile) as of 2026-10-22. — FIRST EPSS