DELMIA Factory Software Vulnerability Exploited in Attacks, CISA Issues Warning

What's Happening?

A critical vulnerability in DELMIA Apriso factory software, developed by Dassault Systèmes, is being actively exploited by threat actors, according to a warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability, identified as CVE-2025-5086, has a CVSS score of 9.0 and is described as a deserialization of untrusted data issue. It affects DELMIA Apriso releases from 2020 to 2025. The flaw was publicly disclosed in June, but detailed technical information was not provided by the vendor. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and has urged federal agencies to patch the flaw by October 2, as per the Binding Operational Directive 22-01. The software is widely used in industries such as aerospace, defense, automotive, and high-tech across North America, Europe, and Asia.

Why It's Important?

The exploitation of this vulnerability poses significant risks to industries that rely on DELMIA Apriso for manufacturing operations management. The software's role in connecting factory equipment with enterprise resource planning systems makes it a critical component in the manufacturing process. If left unpatched, the vulnerability could lead to remote code execution, potentially allowing attackers to disrupt manufacturing operations, steal sensitive data, or cause financial losses. The urgency of CISA's directive highlights the potential impact on national security and economic stability, as the affected industries are integral to the supply chain and infrastructure.

What's Next?

Organizations using DELMIA Apriso are advised to prioritize patching the vulnerability to mitigate the risk of exploitation. CISA's directive for federal agencies to patch by October 2 underscores the need for immediate action. The cybersecurity community will likely continue monitoring for further exploitation attempts and may release additional guidance or tools to assist in securing affected systems. Stakeholders in the affected industries should remain vigilant and consider implementing additional security measures to protect their operations.