Historical catalog analysis: CISA added this entry on September 11, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-5086 is a deserialization of untrusted data vulnerability (CWE-502) affecting Dassault Systèmes DELMIA Apriso. In an industrial context, this flaw could allow an attacker to achieve remote code execution (RCE). Because DELMIA Apriso functions as a Manufacturing Execution System (MES), it sits at the intersection of business logic and physical production, orchestrating how products are made on the shop floor.
Exposure and applicability
This vulnerability applies to organizations utilizing DELMIA Apriso for manufacturing orchestration. The risk is centered on the system’s handling of untrusted data during deserialization. While CISA added this to the Known Exploited Vulnerabilities (KEV) catalog on September 11, 2025, it remains unknown whether this flaw has been utilized in ransomware campaigns.
Remediation priorities
Our analysis suggests that OT security leaders and plant managers prioritize the following actions based on vendor guidance:
- Vendor Mitigation Review: Consult the Dassault Systèmes Trust Center specifically for CVE-2025-5086 to identify applicable patches or configuration changes. This is the primary method for addressing the root cause.
- Network Segmentation: Ensure that the MES environment is isolated from untrusted networks. Restricting access to the DELMIA Apriso server could reduce the likelihood of an external actor reaching the vulnerable deserialization point.
- Service Evaluation: In scenarios where mitigations are unavailable or cannot be applied due to operational constraints, evaluate the necessity of the product’s current deployment or consider discontinuing use as a last resort to eliminate the risk.
How to validate remediation
Validation should be conducted through authorized change control processes and in accordance with OEM guidelines. We recommend the following checkpoints:
- Version Verification: Confirm that the installed version of DELMIA Apriso matches the patched version specified by Dassault Systèmes.
- Configuration Audit: If a configuration-based mitigation was applied, verify the setting across all production and redundant nodes.
- Access Control Log Review: Verify that network access to the MES is restricted to authorized engineering workstations and required industrial interfaces, reducing the attack surface.
Limits and open questions
It is important to note that a version check alone does not guarantee security, as other configuration errors or secondary vulnerabilities may exist. The specific entry path for the deserialization flaw—and whether it requires authentication—is not detailed in the provided source data. Furthermore, while CISA has set a remediation deadline of October 2, 2025, for federal agencies, this date is a regulatory requirement for those entities and not a technical expiration of the vulnerability itself.
Source and editorial note
CVE-2025-5086: Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability · Source date: September 11, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: September 14, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 14, 2026 at 01:27 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗