CISA Urges Immediate Patching: Critical Dassault Systèmes Flaw (CVE-2025-5086) Actively Exploited

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities (KEV) Catalog, following confirmed evidence of active exploitation in the wild. Tracked as CVE-2025-5086, the vulnerability has a CVSS score of 9.0 and stems from a deserialization of untrusted data, with Dassault’s advisory noting that it could lead to remote code execution.

According to Dassault’s advisory, a deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution. Exploitation attempts have been observed, and the attacks have been traced to the IP address 156.244.33[.]162, with the exploit delivered via SOAP-based POST requests to the vulnerable endpoint /apriso/WebServices/FlexNetOperationsService[.]svc/Invoke and using a ZIP-compressed Windows executable hidden in Base64-encoded payloads.

Dassault has released patches for all affected versions (Release 2020–2025), and U.S. federal agencies must remediate the flaw by 2 October 2025 to secure their networks.