EUVD-2025-16682
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Description
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Analysis
Dassault Systemes DELMIA Apriso (releases 2020-2025) contains an unauthenticated deserialization vulnerability (CVE-2025-5086, CVSS 9.0) that enables remote code execution on manufacturing execution systems. KEV-listed with EPSS 39.2% and public PoC, this vulnerability threatens industrial manufacturing operations by targeting the MES (Manufacturing Execution System) layer that controls production processes.
Technical Context
DELMIA Apriso is a Manufacturing Execution System (MES) that manages production operations, quality control, and supply chain processes in manufacturing environments. The deserialization vulnerability allows unauthenticated code execution on the MES server, which directly interfaces with production floor systems including PLCs, SCADA, and quality control equipment. Compromise of the MES layer can disrupt or manipulate manufacturing processes.
Affected Products
['DELMIA Apriso Release 2020 through Release 2025']
Remediation
Apply Dassault Systemes security update immediately. Isolate Apriso servers from internet access. Implement network segmentation between IT and OT networks. Audit production records for unauthorized modifications. Monitor MES access logs for suspicious activity.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today