DELMIA Factory Software Vulnerability Exploited in Attacks

Threat actors are exploiting a critical-severity vulnerability in DELMIA Apriso factory software, according to CISA. Tracked as CVE-2025-5086, the flaw has a CVSS score of 9.0 and stems from a deserialization of untrusted data, affecting DELMIA Apriso releases from 2020 through 2025. The bug was publicly disclosed in June, but the vendor’s advisory did not share technical details beyond noting that it could be exploited for remote code execution.

On 12 September 2025, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch by 2 October under BOD 22-01. Security researchers have observed exploitation attempts, with Johannes Ullrich of the SANS Internet Storm Center reporting that the exploit scans originate from 156.244.33[.]162 and that the payload sometimes evades VirusTotal detections while being flagged by Hybrid Analysis. Given DELMIA Apriso’s role in linking factory equipment with ERP systems, mitigation for CVE-2025-5086 is advised as a priority.