DELMIA Apriso EUVD-2026-42177

The attacker needs network reachability to the DELMIA Apriso application/authentication endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, unauthenticated, low-complexity, and requires no user interaction against affected deployments running any Release from 2020 through 2026. The primary limiting factor is exposure: instances confined to isolated OT/plant networks or placed behind a VPN/IP allowlist are not reachable by external attackers, which materially reduces real-world risk. The advisory does not indicate that a non-default feature or configuration toggle is required, so any reachable in-range instance should be treated as exploitable until patched.

The signals are largely consistent and point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes network-reachable, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity, and availability loss, and 'privileged access to the server' aligns with that impact. Countering the raw score, EPSS is not supplied, the vulnerability is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automatable exploitation yet - current urgency rests on the CVSS profile and the product's role, not on observed attacks. SSVC-style inputs (exploitation status, automatable) are absent from the data and cannot be asserted. Because DELMIA Apriso authentication-class flaws have historically drawn attacker interest, the low observed-exploitation signal should be read as 'not yet weaponized,' not 'low real risk'; internet-exposed instances warrant expedited patching.

An attacker who can reach the DELMIA Apriso server over the network sends crafted requests to the authentication interface that the application incorrectly accepts as valid, obtaining a privileged session without credentials. From there they read and alter manufacturing execution data, production orders, and configuration, or disrupt operations. No POC is currently published, but the low attack complexity makes reliable exploitation plausible once details circulate.