erroneo.us
Search all guides⌘K

Security Digest · Jun 2, 2025 · Vulnerability · Other

DELMIA Apriso: Three Exploited Flaws in Factory MES Software

DELMIA Apriso 2020-2025 has a deserialization RCE and an unauthenticated account-to-webshell chain, all in CISA KEV. Confirm the 2025 fixes, then hunt.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Fixes have existed since mid-2025, so this is about confirming every Apriso server got them and hunting for rogue accounts and web shells, because all three bugs were exploited and the chain needs no login.

Who must act: Manufacturers running DELMIA Apriso Release 2020 through 2025, especially where its web services are reachable from the internet, partner networks or broad internal segments.

Who can relax: Organizations that do not run DELMIA Apriso; other DELMIA and 3DEXPERIENCE products are not named in these advisories.

Affected
DELMIA Apriso Release 2020 (GA through SP4)
Release 2021, 2022 and 2023 (GA through SP3)
Release 2024 and 2025 (GA through SP1)
Fixed in
Remediation per Dassault Systèmes knowledge-base articles QA00000419521 (CVE-2025-5086), QA00000424401 (CVE-2025-6204) and QA00000424104 (CVE-2025-6205); fixed build numbers are not published on the public advisories
CVSS
9.1 (v3.1, CNA)
EPSS
96.9% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every DELMIA Apriso server and note its release and service pack.
  2. Apply Dassault's remediation for all three CVEs from its support knowledge base, and confirm with 3DS support that your release and SP are covered.
  3. Keep Apriso web services off the internet and restrict the SOAP endpoints to known integration hosts.
  4. Review Apriso user accounts created since mid-2025, especially any with the Production User role.
  5. Search the portal uploads directory and web root for .asp, .aspx or .ashx files you did not deploy.

How to check if you are affected or compromised

  • Web logs: POST /apriso/WebServices/FlexNetOperationsService.svc/Invoke with SOAPAction http://tempuri.org/IFlexNetOperationsService/Invoke (CVE-2025-5086 attempts seen by SANS from 156.244.33.162)
  • Web logs: unexpected callers of /Apriso/MessageProcessor/FlexNetMessageProcessor.svc, UploadFile requests with ../ in the filename, and requests to /apriso/portal/uploads/*.asp
  • Unfamiliar Apriso accounts, particularly with the Production User role
  • Child processes such as cmd.exe or powershell.exe spawned by the IIS worker (w3wp.exe) on Apriso servers

What happened#

DELMIA Apriso is Dassault Systèmes' manufacturing operations and execution (MES) platform. SecurityWeek notes its use in aerospace and defense, automotive, high-tech and industrial equipment. Three flaws disclosed in 2025 all ended up in CISA's KEV catalog.

  • CVE-2025-5086 is a deserialization flaw that can lead to remote code execution, published June 2, 2025 (advisory). The CNA scores it CVSS 3.1 9.0 with no login required, and the CVE record credits Hacktron AI. On September 3, SANS ISC reported SOAP requests to /apriso/WebServices/FlexNetOperationsService.svc/Invoke. They carried a .NET gadget chain that loads a gzip-compressed Windows executable. The source was 156.244.33.162, which the author thought might be a scanner. CISA added the CVE to KEV on September 11.
  • CVE-2025-6205 (missing authorization, CVSS 9.1) and CVE-2025-6204 (code injection, CVSS 8.0) were published August 4, 2025 (advisories for 6205 and 6204). ProjectDiscovery showed how they chain:
    • The SOAP endpoint /Apriso/MessageProcessor/FlexNetMessageProcessor.svc accepts unauthenticated requests that create an account with the "Production User" role.
    • That account can then call /Apriso/webservices/1.1/operation.svc/UploadFile, whose filename is not normalized. Path traversal drops an .asp file into the web-served portal uploads folder.
    CISA added both to KEV on October 28.

No public report names the attackers or describes what they did after gaining access.

Who is affected#

The CVE records list the same range for all three bugs: Release 2020 GA through SP4, 2021 to 2023 GA through SP3, and 2024 and 2025 GA through SP1. Dassault's public advisories give no fixed build numbers. Instead they point to customer-login knowledge-base articles: QA00000419521 for 5086, QA00000424401 for 6204 and QA00000424104 for 6205.

Do you really need to act?#

Check, yes. Panic, no. The fixes date from June and August 2025, and an MES server should not be reachable from the internet in the first place. But the 6205/6204 chain needs no credentials, it is documented in detail, and public scanner templates exist for it. A server that missed the patches, or was exposed to partners or the internet while unpatched, could already hold a rogue account or a web shell.

What to do now#

  1. List every Apriso server with its release and service pack.
  2. Apply Dassault's remediation for all three CVEs, and confirm with 3DS support that your exact SP is covered.
  3. Keep Apriso off the internet, and limit the MessageProcessor and WebServices SOAP endpoints to known integration hosts.
  4. Review user accounts created since mid-2025, especially any with the Production User role.
  5. On each server, run Get-ChildItem -Recurse -Include *.asp,*.aspx,*.ashx over the Apriso portal folders and investigate any file you did not deploy.

How to tell if you were hit#

Search IIS logs (by default under C:\inetpub\logs\LogFiles) for the following, using for example Select-String -Pattern 'FlexNetOperationsService|FlexNetMessageProcessor|UploadFile':

  • POSTs to FlexNetOperationsService.svc/Invoke carrying the SOAPAction http://tempuri.org/IFlexNetOperationsService/Invoke;
  • FlexNetMessageProcessor.svc calls from hosts that are not your integrations;
  • UploadFile requests with ../ in the filename;
  • hits on /apriso/portal/uploads/ script files.

Also watch for w3wp.exe spawning cmd.exe or powershell.exe. If any of these turn up, treat the server as compromised and rotate its service and database credentials.

Timeline#

  • — ProjectDiscovery reports the account-creation and upload flaws to 3DS.
  • — CVE-2025-5086 is published.
  • — CVE-2025-6204 and CVE-2025-6205 are published.
  • — SANS ISC reports exploit attempts for CVE-2025-5086.
  • — CVE-2025-5086 is added to KEV (due Oct 2).
  • — ProjectDiscovery publishes the chain.
  • — CVE-2025-6204 and CVE-2025-6205 are added to KEV (due Nov 18).

Vulnerability records

  • CVE-2025-5086 · KEV 2025-09-11 · A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
  • CVE-2025-6204 · KEV 2025-10-28 · An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an…
  • CVE-2025-6205 · KEV 2025-10-28 · A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Dassault Systèmes — CVE-2025-5086 security advisory 3ds.com
  2. Dassault Systèmes — CVE-2025-6204 security advisory 3ds.com
  3. Dassault Systèmes — CVE-2025-6205 security advisory 3ds.com
  4. CVE record — CVE-2025-5086 cve.org
  5. CVE record — CVE-2025-6205 cve.org
  6. CISA — Known Exploited Vulnerabilities: CVE-2025-5086 cisa.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2025-6205 cisa.gov
  8. SANS ISC — Exploit Attempts for Dassault DELMIA Apriso, CVE-2025-5086 isc.sans.edu
  9. ProjectDiscovery — Remote Code Execution in DELMIA Apriso projectdiscovery.io

Coverage and analysis

  1. SecurityWeek — DELMIA factory software vulnerability exploited in attacks securityweek.com
  2. SecurityWeek — CISA warns of exploited DELMIA factory software vulnerabilities securityweek.com