Latest Dassault Systèmes DELMIA Apriso vulnerability #
Dassault Systèmes (3DS) has disclosed a vulnerability in DELMIA Apriso that may allow a remote, unauthenticated adversary to perform remote code execution (RCE) due to deserialization of untrusted data. This vulnerability has been designated CVE-2025-5086 and has been rated critical with a CVSS score of 9.0. There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected
- DELMIA Apriso 2020 versions prior to and including 2020 SP4
- DELMIA Apriso 2021 versions prior to and including 2021 SP3
- DELMIA Apriso 2022 versions prior to and including 2022 SP3
- DELMIA Apriso 2023 versions prior to and including 2023 SP3
- DELMIA Apriso 2024 versions prior to and including 2024 SP1
- DELMIA Apriso 2025 versions prior to and including 2025 SP1
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to upgrade affected versions of DELMIA Apriso 2020 through 2025 to the latest security patch as quickly as possible.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:http AND protocol:http AND has:last.html.title AND last.html.title:="DELMIA Apriso%"
