CVE-2025-5086

What it actually does

DELMIA Apriso Release 2020 through Release 2025 contains a deserialization of untrusted data flaw that can allow a remote attacker to submit crafted serialized input that is interpreted by the application as trusted objects. If a vulnerable code path is reachable, attacker-controlled object data can trigger unintended method execution and result in remote code execution in the security context of the Apriso application or service account. With a CVSS score of 9.0, KEV listing, high EPSS probability, and active in-the-wild exploitation, this should be treated as a critical externally exploitable application compromise risk.

Why it matters to the business

Successful exploitation can give an attacker control over systems supporting manufacturing operations, execution workflows, production management, or related operational technology integrations. This can lead to production disruption, theft or manipulation of manufacturing data, lateral movement into adjacent enterprise or industrial systems, deployment of malware, and extended downtime. Because this vulnerability is in CISA KEV with a remediation deadline of 2025-10-02 and has active exploitation reported, organizations running affected Apriso releases should prioritize emergency remediation over normal patch cycles.

How an attack unfolds

An attacker first identifies an exposed DELMIA Apriso instance running an affected release from 2020 through 2025. They then locate an endpoint or workflow that accepts serialized data or indirectly processes attacker-controlled object data. The attacker sends a specially crafted serialized payload designed to abuse unsafe deserialization behavior. When the Apriso application deserializes the payload, attacker-supplied object logic executes on the server, potentially launching system commands, writing web-accessible files, creating persistence, or downloading follow-on tooling. In active campaigns, this type of vulnerability is commonly used for initial access, post-exploitation staging, credential access, and lateral movement. Known public reporting associates this vulnerability with active exploitation of Dassault Systèmes DELMIA Apriso instances, so defenders should assume internet-reachable or partner-reachable deployments may already have been probed or attacked.

How to fix it

Upgrade DELMIA Apriso to a vendor-supported fixed release or apply the relevant Dassault Systèmes security update for all affected Release 2020 through Release 2025 deployments. Because exact fixed versions were not provided in the input, consult Dassault Systèmes advisories and support channels for the corrected build applicable to the deployed Apriso release train. If immediate patching is not possible, restrict network access to Apriso to only required trusted users, partner networks, and application integrations; remove direct internet exposure; enforce strong authentication; place the service behind a WAF or reverse proxy where inspection rules can block suspicious serialized payloads; and disable or isolate vulnerable integrations that process serialized input if vendor guidance allows. Rotate credentials and secrets accessible to the Apriso application after remediation if exploitation is suspected, because code execution may have exposed them.

How to confirm the fix worked

Confirm the deployed Apriso version and build are no longer within the vulnerable Release 2020 through Release 2025 affected range or have the vendor-provided security fix installed. Validate from both administrative interfaces and server-side installation metadata where available. Re-scan externally and internally to ensure Apriso is not unnecessarily exposed to the internet or untrusted networks. Review WAF, reverse proxy, and application logs to confirm blocked or absent deserialization exploit attempts after remediation. Where feasible, use a safe authenticated vulnerability check from a trusted scanner or vendor-supported validation method rather than attempting exploit payloads. Confirm that application services were restarted after patching and that no unknown web shells, new services, scheduled tasks, or unexpected child processes remain on the host.

Typical attack path

1. Scan the internet, partner networks, or exposed enterprise ranges for DELMIA Apriso services.
2. Fingerprint the Apriso release or application behavior to determine whether it may fall within Release 2020 through Release 2025.
3. Send crafted serialized data to a vulnerable Apriso endpoint or workflow.
4. Trigger unsafe deserialization and execute attacker-controlled code on the application server.
5. Run discovery commands to identify the host, domain, service account privileges, network reachability, and installed security tools.
6. Drop a web shell, loader, scheduled task, service, or other persistence mechanism.
7. Use stolen credentials, application secrets, or network access to move laterally into manufacturing, database, file share, or enterprise systems.
8. Exfiltrate sensitive operational data, disrupt production processes, or stage additional malware.

How to detect it

Look for evidence of exploitation in application logs, web server or reverse proxy logs, WAF events, endpoint detection telemetry, Windows Event Logs or Linux audit logs depending on platform, process creation logs, file integrity monitoring, and outbound network telemetry from Apriso servers. Prioritize suspicious requests containing serialized object payloads, unusually large encoded parameters, unexpected POST requests to Apriso endpoints, server errors referencing deserialization, and any Apriso application process spawning operating system commands. On Windows, review process creation events such as Event ID 4688 and Sysmon Event ID 1 for Apriso-related parent processes launching cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl.exe, or wget.exe. Review file creation events for newly written executable files, scripts, archives, or web-accessible files under Apriso application directories. Review authentication logs for service account logons from unusual hosts and network logs for new outbound connections from Apriso servers to unfamiliar IPs, file-sharing services, paste sites, VPS providers, or command-and-control infrastructure. Because no stable public CVE-specific payload marker is provided, detections should focus on exploitation behaviors: unsafe deserialization errors followed by command execution, anomalous child processes, unexpected file writes, and outbound staging traffic.

• System.Runtime.Serialization.SerializationException
• InvalidCastException
• ObjectDataProvider
• ysoserial
• ysoserial.net
• BinaryFormatter
• TypeNameHandling
• __type
• Process.Start
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• curl.exe http
• wget http
• whoami
• ipconfig /all
• net user
• net group
• nltest /domain_trusts
• schtasks /create
• sc create

What your security team should do

• Treat this as an emergency remediation item because it is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score.
• Inventory all DELMIA Apriso deployments, including non-production, disaster recovery, partner-facing, and segmented manufacturing environments.
• Patch or upgrade affected Release 2020 through Release 2025 systems using Dassault Systèmes guidance before or as soon as possible relative to the KEV due date of 2025-10-02.
• Immediately remove direct internet exposure and restrict Apriso access to required trusted networks if patching cannot be completed at once.
• Hunt for prior exploitation across Apriso application logs, web server logs, endpoint telemetry, authentication logs, and network egress records since at least the publication date of 2025-06-02, with extra focus on September 2025 active exploitation activity.
• Investigate any Apriso server spawning command shells, scripting engines, file download utilities, or archive tools as suspicious.
• Rotate Apriso service account credentials, integration secrets, API keys, and database credentials if compromise is suspected or confirmed.
• Perform endpoint forensic triage on Apriso application servers for web shells, new scheduled tasks, unauthorized services, unusual binaries, and persistence mechanisms.
• Increase monitoring on Apriso servers for outbound connections, lateral movement, credential dumping behavior, and unusual access to manufacturing or operational data stores.