DELMIA Apriso Remote Code Execution via Deserialization (CVE-2025-5086)

Historical catalog analysis: CISA added this entry on September 11, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-5086 is a vulnerability in Dassault Systèmes DELMIA Apriso involving the deserialization of untrusted data (CWE-502). This flaw could allow an attacker to achieve remote code execution (RCE) on the affected system. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on September 11, 2025.

Exposure and applicability

This vulnerability affects organizations deploying DELMIA Apriso. The risk is primarily centered on the application’s handling of serialized data; if an attacker can provide a specially crafted malicious payload that the system deserializes without sufficient validation, they may execute arbitrary code in the context of the application process.

Remediation priorities

Based on the reported vulnerability and its inclusion in the CISA catalog, we analyze the following prioritization for defenders:

1. Asset Identification: Immediately identify all instances of DELMIA Apriso within the environment, including on-premises and cloud deployments.
2. Vendor Mitigation Application: Prioritize the application of mitigations as specified by Dassault Systèmes in their security advisories.
3. Cloud Service Review: For organizations utilizing cloud-based versions of the product, review configurations against BOD 22-01 guidance to ensure shared responsibility obligations are met.
4. Decommissioning Evaluation: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific legacy version, evaluate the necessity of the service versus the risk of RCE and consider discontinuing use.

How to validate remediation

Verifying that exposure has been reduced requires more than a version check. We recommend the following validation approach:

• Configuration Audit: Confirm that the specific mitigations recommended by the vendor are active and correctly configured across all identified nodes.
• Traffic Analysis: Monitor for unusual patterns of serialized data being sent to the application endpoints, which may indicate attempts to trigger the deserialization flaw.
• Controlled Testing: In a non-production environment, security teams should attempt to verify that the entry point used for the deserialization is no longer accessible or that the payload is rejected by the updated system.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Furthermore, while vendor instructions provide a path to remediation, the specific technical details of the exploit chain are not fully detailed in the public catalog entry. Residual risk persists if mitigations are applied inconsistently across a distributed environment or if compensating controls (such as network segmentation) are absent, potentially allowing an attacker to reach the vulnerable service from other compromised internal assets.

Source and editorial note

CVE-2025-5086: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability · Source date: September 11, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: September 14, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 03, 2026 at 00:11 UTC.

Request a Vulnerability Assessment