CVE-2025-5086
📋 TL;DR
CVE-2025-5086 is a deserialization vulnerability in Dassault Systèmes DELMIA Apriso that allows remote attackers to execute arbitrary code by sending specially crafted data. This affects all Apriso installations from Release 2020 through Release 2025. Organizations using these versions for manufacturing operations management are at risk.
💻 Affected Systems
- Dassault Systèmes DELMIA Apriso
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal sensitive manufacturing data, disrupt production operations, and pivot to other network systems.
Likely Case
Remote code execution leading to data theft, ransomware deployment, or disruption of manufacturing processes.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting isolated Apriso components.
🎯 Exploit Status
CISA has confirmed active exploitation in the wild. The vulnerability is being actively targeted by threat actors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Dassault Systèmes for specific patch information
Vendor Advisory: https://www.3ds.com/vulnerability/advisories
Restart Required: Yes
Instructions:
1. Contact Dassault Systèmes support for the specific security patch
2. Apply the patch following vendor instructions
3. Restart Apriso services as required
4. Test functionality after patching
🔧 Temporary Workarounds
Network Segmentation
allIsolate Apriso systems from internet and restrict internal network access
Application Firewall Rules
allImplement WAF rules to block suspicious deserialization patterns
🧯 If You Can't Patch
- Immediately isolate Apriso systems from internet and restrict to necessary internal access only
- Implement strict network monitoring and alerting for suspicious Apriso-related traffic
🔍 How to Verify
Check if Vulnerable:
Check Apriso version against affected range (2020-2025 releases). Review system logs for deserialization errors or suspicious activity.Check Version:
Check through Apriso administration interface or consult system documentationVerify Fix Applied:
Verify patch installation through Apriso administration console and confirm version is no longer in vulnerable range.📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors in Apriso logs
- Suspicious process creation from Apriso services
- Unexpected network connections from Apriso systems
Network Indicators:
- Unusual traffic patterns to/from Apriso ports
- Suspicious serialized data payloads in network traffic
SIEM Query:
source="apriso*" AND (event_type="deserialization_error" OR process_name="cmd.exe" OR process_name="powershell.exe")