Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
CISA KEV · ACTIVELY EXPLOITED
CRITICAL severity

CVE-2025-5086 — Delmia Apriso

CRITICAL

CVE-2025-5086 is a critical-severity (CVSS 9) Deserialization of Untrusted Data vulnerability in 3ds delmia apriso. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-09-11) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-09-11. Federal agencies were required to remediate by 2025-10-02.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2025-5086.

EPSS Exploitation Probability

via FIRST.org ↗
96.9%probability of exploitation in next 30 days
Very High Risk+6.90%
Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk
26.2%50.8%75.4%100.0%44.1%96.9%Apr 26Jul 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2025-5086 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.

Description

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

Affected Products

1 product · 1 configurations
Application
delmia apriso3ds
≥ 2020 && ≤ 2025
range

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every 3ds delmia apriso deployment and check each version against the affected-products list above.

  2. Remediation status

    No patch has shipped for CVE-2025-5086 yet — track the 3ds delmia apriso advisory for a fixed release and apply the workarounds below in the meantime.

  3. Mitigate without a patch

    Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

How to detect CVE-2025-5086

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2025-5086 -u https://target
Template
Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization
Severity
critical
Impact
Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code on DELMIA Apriso servers, achieving complete system compromise.
Remediation
Upgrade DELMIA Apriso to a version later than Release 2025 that properly validates deserialized data.

Template by ProjectDiscovery nuclei-templates (hacktronai, iamnoooob, pdresearch), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
O3 Security · Runtime Protection

Is CVE-2025-5086 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2025-5086: Delmia Apriso Deserialization (KEV)