CVE-2025-5086 is a deserialization-of-untrusted-data vulnerability in Dassault Systemes DELMIA Apriso, a manufacturing execution/operations management (MES) platform used to run and connect factory-floor production processes to enterprise systems, that lets a remote attacker send crafted data to achieve remote code execution; CISA added it to the Known Exploited Vulnerabilities catalog after confirming active, in-the-wild scanning and exploitation attempts.
Vulnerability summary
CVSS base score
9
Critical severity
EPSS score (FIRST)
96.9%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2025-5086 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Dassault Systemes DELMIA Apriso | cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:* | Release 2020 through Release 2025 |
What does this mean for affected devices?
CVE-2025-5086 is a deserialization of untrusted data vulnerability (CWE-502) affecting Dassault Systemes DELMIA Apriso Release 2020 through Release 2025. DELMIA Apriso is manufacturing operations management (MES) software that factories use to run production processes and connect the shop floor to enterprise resource planning systems, so a remote-code-execution flaw in it reaches directly into operational technology environments (NVD).
NVD lists this CVE as fully analyzed (status "Analyzed"), recording Dassault's own CVSS v3.1 submission of 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable with high attack complexity but no privileges or user interaction required, and complete compromise of confidentiality, integrity and availability once exploited (NVD).
CISA added CVE-2025-5086 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-09-11, with a required-action due date of 2025-10-02, directing agencies to apply vendor mitigations, follow BOD 22-01 guidance for any cloud-hosted instances, or discontinue use of the product if mitigations are unavailable (CISA KEV).
The SANS Internet Storm Center documented live exploitation attempts against the vulnerable WebServices/FlexNetOperationsService endpoint, with scans delivering a crafted SOAP payload that decodes to a GZIP-compressed Windows executable (SANS ISC — Exploit Attempts for Dassault DELMIA Apriso CVE-2025-5086).
Dassault Systemes' own vulnerability advisories page lists the fix as upgrading to a DELMIA Apriso release after 2025 that validates deserialized data before processing it (Dassault Systemes Vulnerability Advisories).
As of 2026-10-22, FIRST scores the probability of exploitation at 0.9692 (99.89th percentile) — among the highest EPSS scores possible, consistent with a KEV-listed, actively-scanned remote code execution flaw in internet-reachable manufacturing software (FIRST EPSS).
Any organization running DELMIA Apriso should upgrade past Release 2025 immediately, treat any internet-exposed instance as likely already probed given the documented scanning activity, and review logs for the SOAP-based exploitation pattern SANS published.
Evidence
- Deserialization of untrusted data (CWE-502) in DELMIA Apriso Release 2020 through 2025 allows remote code execution. — NVD
- CVSS v3.1 base score 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, Dassault-submitted, status Analyzed. — NVD
- Added to the CISA KEV catalog on 2025-09-11, required-action due date 2025-10-02. — CISA KEV
- Live exploitation attempts observed against the WebServices/FlexNetOperationsService endpoint, delivering a GZIP-compressed Windows executable via SOAP payload. — SANS ISC
- EPSS score is 0.9692 (99.89th percentile) as of 2026-10-22. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What specific endpoint have researchers observed attackers targeting for this flaw?
Per the SANS Internet Storm Center, live exploitation attempts have targeted the WebServices/FlexNetOperationsService endpoint, delivering a crafted SOAP payload that decodes to a GZIP-compressed Windows executable.
Why does the CVSS vector for this CVE list a high attack complexity if it's being actively exploited?
Dassault's own CVSS v3.1 submission (9.0, critical) uses a vector with AC:H (high attack complexity) and S:C (scope changed), per NVD — a combination that can still be scripted reliably once the specific preconditions are understood, as the SANS-documented in-the-wild scanning shows.
What does CISA tell federal agencies to do if they can't immediately apply a fix?
Per the CISA KEV catalog entry, agencies are directed to apply vendor mitigations, follow BOD 22-01 guidance for any cloud-hosted instances, or discontinue use of the product entirely if mitigations aren't available.
Why is a vulnerability in manufacturing software treated as an OT/ICS concern rather than a purely IT one?
DELMIA Apriso is manufacturing operations management (MES) software that factories use to run production processes and connect the shop floor to enterprise resource planning systems, so per NVD's own description of the affected product, a remote-code-execution flaw in it reaches directly into operational technology environments rather than staying confined to a back-office IT system.
How likely is a given internet-exposed DELMIA Apriso instance to already have been probed?
Per FIRST EPSS, as of 2026-10-22 CVE-2025-5086 scores 0.9692 (99.89th percentile) — among the highest exploitation-probability scores possible, consistent with the active scanning the SANS Internet Storm Center documented against internet-reachable instances.
Questions about this page?