CVE-2025-5086 (CVSS 9.0): A Critical RCE in DELMIA Apriso with Exploit Attempts Seen in the Wild

CVE-2025-5086 (CVSS 9.0) is a critical RCE flaw in DELMIA Apriso that has seen real-world exploit attempts since the June 2025 advisory. According to Dassault Systèmes, the deserialization of untrusted data vulnerability affects Release 2020 through Release 2025 and could lead to remote code execution. Dr. Johannes B.

Ullrich of SANS[.]edu said exploit attempts targeting Apriso servers have been observed, with attacks originating from the IP address 156.244.33[.]162 and using SOAP-based POST requests to the vulnerable /apriso/WebServices/FlexNetOperationsService[.]svc/Invoke endpoint. The payload involves .NET deserialization with a Base64-encoded, GZIP-compressed Windows executable, and Hybrid Analysis has classified the binary as malicious, although VirusTotal initially reported no detection.

The article urges organisations to apply the patch across all supported versions, monitor for suspicious SOAP envelopes and large Base64 payloads, segment MOM/MES systems from the internet, and hunt for indicators linked to the 156.244.33[.]162 host.