FKIE_CVE-2025-5086

Vulnerability from fkie_nvd - Published: 2025-06-02 18:15 - Updated: 2026-06-17 09:47
Severity
9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
References
3DS.Information-Security@3ds.comhttps://www.3ds.com/vulnerability/advisoriesVendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256Exploit, Technical Description, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086US Government Resource
Impacted products
Vendor Product Version
3ds delmia_apriso *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "DELMIA Apriso",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "Release 2020 SP4",
              "status": "affected",
              "version": "Release 2020 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2021 SP3",
              "status": "affected",
              "version": "Release 2021 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2022 SP3",
              "status": "affected",
              "version": "Release 2022 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2023 SP3",
              "status": "affected",
              "version": "Release 2023 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2024 SP1",
              "status": "affected",
              "version": "Release 2024 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 2025 SP1",
              "status": "affected",
              "version": "Release 2025 Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "3DS.Information-Security@3ds.com"
    }
  ],
  "cisaActionDue": "2025-10-02",
  "cisaExploitAdd": "2025-09-11",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Dassault Syst\u00e8mes DELMIA Apriso Deserialization of Untrusted Data Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "809F8ACE-5686-4178-ACF7-D6968035FCF5",
              "versionEndIncluding": "2025",
              "versionStartIncluding": "2020",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de deserializaci\u00f3n de datos no confiables que afecta a DELMIA Apriso desde la versi\u00f3n 2020 hasta la versi\u00f3n 2025 podr\u00eda provocar una ejecuci\u00f3n remota de c\u00f3digo."
    }
  ],
  "id": "CVE-2025-5086",
  "lastModified": "2026-06-17T09:47:10.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0,
        "source": "3DS.Information-Security@3ds.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5086",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-12T03:56:12.885164Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-06-02T18:15:25.010",
  "references": [
    {
      "source": "3DS.Information-Security@3ds.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.3ds.com/vulnerability/advisories"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086"
    }
  ],
  "sourceIdentifier": "3DS.Information-Security@3ds.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "3DS.Information-Security@3ds.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.