# CVE-2025-5086: DELMIA Apriso - RCE

> Live exploitation tracking for CVE-2025-5086 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-5086

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.0
- **Public exploit available:** Yes
- **Affected products:** Dassault Systèmes DELMIA Apriso
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** enterprise_software

## Description

A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.

## CrowdSec analysis

[CVE-2025-5086](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-5086) is a remote code execution vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025. Attackers can exploit this flaw to execute arbitrary code on the affected server.

CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-5086 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2025-5086 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending crafted POST requests with malicious payloads to an invoke function located at `/apriso/webservices/flexnetoperationsservice.svc` endpoints, leading to remote code execution.

## Timeline

- 2025-06-02: CVE Published. CVE-2025-5086 is published to NVD.
- 2025-06-12: Rule Released. CrowdSec releases a rule to detect CVE-2025-5086 exploitation attempts against the CrowdSec Network.
- 2025-06-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-5086 for the first time.
- 2025-09-11: CISA KEV. CVE-2025-5086 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-10-02: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5086.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-5086) follows observed exploitation activity for CVE-2025-5086. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.