CVE-2025-5086criticalunder attackCWE-502

CVE-2025-5086: critical vulnerability in Dassault Systèmes DELMIA Apriso

Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

Published · Updated

Follow this CVE+ Monitor DELMIA Apriso

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9epss 97%
from disclosure to weapon
Published on NVDJun 2
CISA KEV+101d
Action required by CISAfederal deadline: 2025-10-02

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

DELMIA Apriso versions 2020-2025 contain a flaw that allows attackers to execute arbitrary code remotely by sending specially crafted data that the application unsafely processes. This is critical because it gives attackers complete control over the system.

Technical detail

The vulnerability exploits unsafe deserialization of untrusted input in DELMIA Apriso 2020-2025, enabling remote code execution without authentication. An attacker can craft malicious serialized objects that execute arbitrary commands when processed by the application, compromising system integrity and confidentiality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Dassault Systèmes · DELMIA Apriso
Related CVEs — Dassault Systèmes DELMIA Apriso

In the same product, most dangerous first.

CVE-2025-6204HIGHImproper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 76.6%KEVCVE-2025-6205CRITICALMissing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 67.2%KEVCVE-2024-3300CRITICALPre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024EPSS 2.9%CVE-2023-2141HIGHUnsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 EPSS 1.0%CVE-2024-3301HIGHPost-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024EPSS 0.7%CVE-2026-9695CRITICALImproper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026EPSS 0.6%