CVE-2025-5086(3ds / delmia_apriso)

LOWCVSS 9.0 · CRITICALCISA KEV

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

3ds CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-10-02. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256

Vendor / third-party advisories

https://www.3ds.com/vulnerability/advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

delmia_apriso

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Affected systems

Vendors

3ds

Products

delmia_apriso

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://www.hacktron.ai/blog/dassault-delmia-apriso-rce?utm_source=x&utm_medium=social-video&utm_campaign=research&utm_content=delmia-apriso

Full discourse1 post

Hacktron AI@HacktronAI1d
A critical vulnerability went undetected through multiple security audits. Hacktron found it in 10 minutes. The vulnerability was in Dassault Systèmes' DELMIA Apriso, manufacturing software used by Boeing, Airbus, Lockheed Martin, and previously Apple. It became CVE-2025-5086. Three months after disclosure, CISA confirmed it was being actively exploited. Security assessments capture a point in time. Attackers don't work on your schedule. Full research: https://www.hacktron.ai/blog/dassault-delmia-apriso-rce?utm_source=x&utm_medium=social-video&utm_campaign=research&utm_content=delmia-apriso
34144192.6K
10.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	3ds	delmia_apriso	-	-	-

Explore more

Back to dashboard 3ds CVEs delmia_apriso vulnerabilities