CVE-2025-5086
Published 2025-06-02 · Updated 2026-06-17 · Source 3DS.Information-Security@3ds.com
Summary
CVE-2025-5086 is a critical-severity (CVSS 9.0) vulnerability in Dassault Systèmes DELMIA Apriso. CISA added it to the Known Exploited Vulnerabilities catalog on September 11, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 2, 2025. CISA does not currently list it as used in ransomware campaigns. Dassault Systèmes has 3 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 3 known-exploited Dassault Systèmes vulnerabilities →Description
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Dassault Systèmes — DELMIA Apriso
Name: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
Date added: 2025-09-11 · Due: 2025-10-02
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.