Actively exploited in the wild
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
Dassault Systèmes - DELMIA Apriso · Listed in the CISA KEV since 2025-09-11. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-5086
CriticalCVSS 9.0KEVSummary
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, potentially leading to full system compromise and production data breach.
Recommendation
Upgrade DELMIA Apriso to the latest version and restrict system access to trusted users only.
Other vulnerabilities in DELMIA Apriso
See all- CVE-2026-9695Critical
An Improper Authentication vulnerability in DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.
- CVE-2025-6205CriticalActively exploited
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
Original NVD description (English source)
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.