Critical Vulnerability CVE-2025-5086 in DELMIA Apriso Actively Exploited; CISA Raises Alarm
On September 12, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) elevated concerns regarding a serious security vulnerability in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software by adding it to its Known Exploited Vulnerabilities (KEV) catalog. This decision follows emerging evidence indicating that the flaw, designated as CVE-2025-5086, is currently being exploited in the wild. The vulnerability has been assigned a high Common Vulnerability Scoring System (CVSS) score of 9.0 out of 10.0, highlighting its critical nature.
According to Dassault, this vulnerability affects versions of DELMIA Apriso from Release 2020 to Release 2025. CISA’s advisory specifies that the identified issue centers on a deserialization of untrusted data, which could potentially allow malicious actors to execute remote code on affected systems. Such a breach poses significant risks to the integrity and security of manufacturing operations that rely on this software.
The impetus for CISA’s warning can be traced back to reports from the SANS Internet Storm Center, which noted attempts to exploit this vulnerability originating from an IP address traced to Mexico. These attacks involved the submission of an HTTP request targeting a specific service within the software infrastructure, highlighting the evolving tactics employed by cyber adversaries.
In evaluating the attack vector of CVE-2025-5086, it is imperative to consider the potential MITRE ATT&CK tactics that may have been leveraged. Initial access techniques could include exploiting the vulnerability to gain foothold within the target environment, while subsequent actions may involve persistence strategies to maintain access. Privilege escalation could also be a key concern, allowing attackers to secure higher-level permissions following their initial exploitation.
Organizations utilizing DELMIA Apriso are strongly urged to assess their version of the software and implement available patches to mitigate any risks associated with this vulnerability. As the cybersecurity landscape continues to evolve, staying vigilant and informed remains crucial for business owners. The proactive identification and remediation of vulnerabilities like CVE-2025-5086 is essential in safeguarding critical infrastructure against sophisticated cyber threats.
In summary, this recent development serves as a stark reminder of the vulnerabilities that can exist within operational software, posing substantial risks not only to individual organizations but potentially affecting broader supply chains and industry sectors. Business owners are advised to remain aware of such vulnerabilities, particularly those that have been recognized by regulatory bodies like CISA, to ensure the continued security of their operations.