PT-2025-23551 · Dsi · Delmia Apriso

Hacktron Ai · Published 2025-06-02 · Updated 2025-10-29 · CVE-2025-5086

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DELMIA Apriso versions 2020 through 2025

Description DELMIA Apriso is affected by a deserialization of untrusted data issue that could lead to remote code execution. This vulnerability is actively exploited and has been observed in attacks utilizing malicious SOAP requests delivering .NET payloads. Exploitation has been traced to Mexico and involves the use of the Trojan.MSIL.Zapchast.gen malware. The vulnerability impacts industries such as aerospace, automotive, manufacturing, and industrial machinery. CISA has added this vulnerability, tracked as CVE-2025-5086, to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal agencies to patch or mitigate by October 2nd. The vulnerability allows unauthenticated attackers to execute code remotely.

Recommendations Apply vendor patches for DELMIA Apriso versions 2020 through 2025. Validate deserialized data to prevent malicious payloads from being processed. As a temporary workaround, discontinue usage of DELMIA Apriso versions 2020 through 2025 if a patch is unavailable.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-06367

CVE-2025-5086

Affected Products

Delmia Apriso

References · 87

• 🔥 https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256 · Exploit
• https://osv.dev/vulnerability/CVE-2025-5086 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5086 · Security Note
• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://3ds.com/trust-center/security/security-advisories/cve-2025-5086 · Security Note
• https://twitter.com/xcybersecnews/status/1966821744083169483 · Twitter Post
• https://twitter.com/cyashadotcom/status/1966519458349871408 · Twitter Post
• https://twitter.com/blueteamsec1/status/1977157665056080259 · Twitter Post
• https://reddit.com/r/TechNadu/comments/1nf6uub/cisa_adds_cve20255086_to_the_known_exploited · Reddit Post
• https://reddit.com/r/pwnhub/comments/1nesbmo/new_vulnerability_added_to_cisas_known_exploited · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1ngtrtw/top_10_trending_cves_14092025 · Reddit Post
• https://twitter.com/lordman1982/status/1968208313016877312 · Twitter Post
• https://twitter.com/Newtalics/status/1966890828472762860 · Twitter Post
• https://twitter.com/Komodosec/status/1977027239608041775 · Twitter Post