CVE-2025-5086: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

CVE-2025-5086 is a deserialization of untrusted data vulnerability affecting Dassault Systèmes DELMIA Apriso. According to CISA, it could lead to remote code execution. This matters for IT and security teams because the product is commonly deployed in manufacturing and operations environments; compromise of an instance can give an attacker a foothold for further lateral movement or disruption of production systems.

Defenders should treat this as a high-priority issue for any organization running the software and confirm all technical details, including exact affected releases, against the vendor advisory.

How it works

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). In this class of flaw, an application accepts serialized objects or data streams from an untrusted source and reconstructs them into live objects without sufficient validation or type restrictions.

An attacker who can supply crafted input to a vulnerable deserialization endpoint or data path can embed malicious object graphs. When the application deserializes that input, the resulting objects may trigger arbitrary code execution under the privileges of the process. Public detail on the precise attack surface or required access level for CVE-2025-5086 is limited; teams must review the vendor advisory for the exact conditions under which untrusted data reaches the deserializer.

Am I affected? How to find it in your systems

Dassault Systèmes DELMIA Apriso is typically found in manufacturing execution system (MES) deployments that manage shop-floor operations, production tracking, and related workflows. It may run on-premises or in hosted environments.

• Inventory all instances by querying software asset management tools, package inventories, and application servers for the presence of DELMIA Apriso components.
• Identify the installed version and configuration of each instance and compare it against the list of affected releases published in the vendor advisory.
• Review network exposure: note any instances reachable from untrusted networks or that accept data from external systems, partners, or user-controlled interfaces.
• Examine application and system logs for anomalous deserialization activity, unexpected process spawning, or connections that coincide with data ingestion points. Specific telemetry signatures are not provided in public summaries and must be derived from the vendor guidance.

If the product is used as a cloud service, also follow applicable BOD 22-01 guidance.

How to remediate

The primary remediation is to apply the mitigations or updates supplied by Dassault Systèmes. Follow the vendor instructions exactly; do not rely on generic version numbers or assumptions.

• Obtain and deploy the vendor-provided patch or configuration change for every affected DELMIA Apriso instance.
• After patching, verify that the vulnerable deserialization paths are no longer reachable or that the updated code correctly rejects untrusted input.
• For the broader CWE-502 class, enforce strict allow-lists of permitted types during deserialization, prefer safer data formats that do not support arbitrary object graphs, and ensure all untrusted input is validated before it reaches any deserializer.
• If mitigations are unavailable, CISA advises discontinuing use of the product.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls:

• Segment affected systems so that only necessary internal hosts can reach the DELMIA Apriso interfaces; block direct internet or partner access where possible.
• Place a web application firewall or reverse-proxy filter in front of any exposed endpoints and apply virtual-patching rules that drop or sanitize traffic matching known deserialization patterns for this product class; tune rules carefully to avoid false positives.
• Disable or restrict any non-essential features, APIs, or data-import functions that accept serialized or complex object data until they can be confirmed safe.
• Increase monitoring and alerting on process creation, unusual outbound connections, and authentication events originating from the Apriso hosts. Retain logs for forensic review.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operational constraints allow.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to full system compromise and subsequent data theft or ransomware deployment, although ransomware use specifically tied to CVE-2025-5086 is not documented. If you suspect an incident, isolate the host, preserve evidence, and follow your incident-response plan. As a quick check for previously leaked credentials, you can run a free exposure scan of your email addresses against known breach data.