U.S. CISA adds Dassault Systèmes DELMIA Apriso flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2025-5086 with a CVSS score of 9.0. The flaw involves deserialization of untrusted data in DELMIA Apriso, affecting releases from 2020 through 2025, and could allow an attacker to trigger remote arbitrary code execution. Hacktron AI is credited with reporting the vulnerability.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies are required to address the identified flaws by the due date to protect networks from exploitation in the KEV catalog. CISA also emphasises that private organisations should review the catalog and remediate the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by 2 October 2025, with the aim of preventing exploitation of this flaw in industrial control and manufacturing environments.