Critical CVE-2025-5086 in DELMIA Apriso Actively Exploited, CISA Issues Warning

The Hacker News reports that CVE-2025-5086 in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management software is now classified as critical and actively exploited, leading to its addition to the Known Exploited Vulnerabilities catalog by CISA, according to CISA. The vulnerability carries a CVSS score of 9.0 and, Dassault says, affects versions from Release 2020 through Release 2025, stemming from a deserialization of untrusted data that could enable remote code execution.

Exploitation attempts were observed originating from the IP address 156.244.33[.]162, geolocated to Mexico, with SANS Internet Storm Center noting activity against the "/apriso/WebServices/FlexNetOperationsService[.]svc/Invoke" endpoint and a Base64 payload that decodes to a Windows executable named fwitxz01.dll. Kaspersky classifies the DLL as Trojan.MSIL.Zapchast[.]gen, describing it as a capable spy that can capture keystrokes, screenshots and other data, with data exfiltration via email, FTP or HTTP.

Federal Civilian Executive Branch agencies are urged to apply updates by 2 October 2025 to mitigate the threat, as the KEV addition follows ongoing exploitation reports.