---
title: "DELMIA Apriso: Three Exploited Flaws in Factory MES Software"
url: https://erroneo.us/security/briefs/delmia-apriso-cve-2025-5086-6204-6205-rce/
description: "DELMIA Apriso 2020-2025 has a deserialization RCE and an unauthenticated account-to-webshell chain, all in CISA KEV. Confirm the 2025 fixes, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-06-02
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-5086", "CVE-2025-6204", "CVE-2025-6205"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# DELMIA Apriso: Three Exploited Flaws in Factory MES Software

**Verdict: Check exposure.** Fixes have existed since mid-2025, so this is about confirming every Apriso server got them and hunting for rogue accounts and web shells, because all three bugs were exploited and the chain needs no login.

- **Who must act:** Manufacturers running DELMIA Apriso Release 2020 through 2025, especially where its web services are reachable from the internet, partner networks or broad internal segments.
- **Who can relax:** Organizations that do not run DELMIA Apriso; other DELMIA and 3DEXPERIENCE products are not named in these advisories.
- **Affected:** DELMIA Apriso Release 2020 (GA through SP4); Release 2021, 2022 and 2023 (GA through SP3); Release 2024 and 2025 (GA through SP1)
- **Fixed:** Remediation per Dassault Systèmes knowledge-base articles QA00000419521 (CVE-2025-5086), QA00000424401 (CVE-2025-6204) and QA00000424104 (CVE-2025-6205); fixed build numbers are not published on the public advisories
- **CVEs:** CVE-2025-5086, CVE-2025-6204, CVE-2025-6205
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every DELMIA Apriso server and note its release and service pack.
2. Apply Dassault's remediation for all three CVEs from its support knowledge base, and confirm with 3DS support that your release and SP are covered.
3. Keep Apriso web services off the internet and restrict the SOAP endpoints to known integration hosts.
4. Review Apriso user accounts created since mid-2025, especially any with the Production User role.
5. Search the portal uploads directory and web root for .asp, .aspx or .ashx files you did not deploy.

### How to check if you are affected

- Web logs: POST /apriso/WebServices/FlexNetOperationsService.svc/Invoke with SOAPAction http://tempuri.org/IFlexNetOperationsService/Invoke (CVE-2025-5086 attempts seen by SANS from 156.244.33.162)
- Web logs: unexpected callers of /Apriso/MessageProcessor/FlexNetMessageProcessor.svc, UploadFile requests with ../ in the filename, and requests to /apriso/portal/uploads/*.asp
- Unfamiliar Apriso accounts, particularly with the Production User role
- Child processes such as cmd.exe or powershell.exe spawned by the IIS worker (w3wp.exe) on Apriso servers

## What happened

DELMIA Apriso is Dassault Systèmes' manufacturing operations and execution (MES) platform. [SecurityWeek](https://www.securityweek.com/delmia-factory-software-vulnerability-exploited-in-attacks/) notes its use in aerospace and defense, automotive, high-tech and industrial equipment. Three flaws disclosed in 2025 all ended up in CISA's KEV catalog.

- **CVE-2025-5086** is a deserialization flaw that can lead to remote code execution, published June 2, 2025 ([advisory](https://www.3ds.com/trust-center/security/security-advisories/cve-2025-5086)). The CNA scores it CVSS 3.1 9.0 with no login required, and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-5086) credits Hacktron AI. On September 3, [SANS ISC](https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256) reported SOAP requests to `/apriso/WebServices/FlexNetOperationsService.svc/Invoke`. They carried a .NET gadget chain that loads a gzip-compressed Windows executable. The source was 156.244.33.162, which the author thought might be a scanner. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086) on September 11.
- **CVE-2025-6205** (missing authorization, CVSS 9.1) and **CVE-2025-6204** (code injection, CVSS 8.0) were published August 4, 2025 (advisories for [6205](https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205) and [6204](https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204)). [ProjectDiscovery](https://projectdiscovery.io/blog/remote-code-execution-in-delmia-apriso) showed how they chain:

   - The SOAP endpoint `/Apriso/MessageProcessor/FlexNetMessageProcessor.svc` accepts unauthenticated requests that create an account with the "Production User" role.
   - That account can then call `/Apriso/webservices/1.1/operation.svc/UploadFile`, whose filename is not normalized. Path traversal drops an `.asp` file into the web-served portal uploads folder.

CISA added both to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6205) on October 28.

No public report names the attackers or describes what they did after gaining access.

## Who is affected

The [CVE records](https://www.cve.org/CVERecord?id=CVE-2025-6205) list the same range for all three bugs: Release 2020 GA through SP4, 2021 to 2023 GA through SP3, and 2024 and 2025 GA through SP1. Dassault's public advisories give no fixed build numbers. Instead they point to customer-login knowledge-base articles: QA00000419521 for 5086, QA00000424401 for 6204 and QA00000424104 for 6205.

## Do you really need to act?

Check, yes. Panic, no. The fixes date from June and August 2025, and an MES server should not be reachable from the internet in the first place. But the 6205/6204 chain needs no credentials, it is documented in detail, and public scanner templates exist for it. A server that missed the patches, or was exposed to partners or the internet while unpatched, could already hold a rogue account or a web shell.

## What to do now

1. List every Apriso server with its release and service pack.
2. Apply Dassault's remediation for all three CVEs, and confirm with 3DS support that your exact SP is covered.
3. Keep Apriso off the internet, and limit the `MessageProcessor` and `WebServices` SOAP endpoints to known integration hosts.
4. Review user accounts created since mid-2025, especially any with the Production User role.
5. On each server, run `Get-ChildItem -Recurse -Include *.asp,*.aspx,*.ashx` over the Apriso portal folders and investigate any file you did not deploy.

## How to tell if you were hit

Search IIS logs (by default under `C:\inetpub\logs\LogFiles`) for the following, using for example `Select-String -Pattern 'FlexNetOperationsService|FlexNetMessageProcessor|UploadFile'`:

- POSTs to `FlexNetOperationsService.svc/Invoke` carrying the SOAPAction `http://tempuri.org/IFlexNetOperationsService/Invoke`;
- `FlexNetMessageProcessor.svc` calls from hosts that are not your integrations;
- `UploadFile` requests with `../` in the filename;
- hits on `/apriso/portal/uploads/` script files.

Also watch for `w3wp.exe` spawning `cmd.exe` or `powershell.exe`. If any of these turn up, treat the server as compromised and rotate its service and database credentials.

## Timeline

- May 14, 2025 — ProjectDiscovery reports the account-creation and upload flaws to 3DS.
- Jun 2, 2025 — CVE-2025-5086 is published.
- Aug 4, 2025 — CVE-2025-6204 and CVE-2025-6205 are published.
- Sep 3, 2025 — SANS ISC reports exploit attempts for CVE-2025-5086.
- Sep 11, 2025 — CVE-2025-5086 is added to KEV (due Oct 2).
- Sep 23, 2025 — ProjectDiscovery publishes the chain.
- Oct 28, 2025 — CVE-2025-6204 and CVE-2025-6205 are added to KEV (due Nov 18).

## Sources

1. [Dassault Systèmes — CVE-2025-5086 security advisory](https://www.3ds.com/trust-center/security/security-advisories/cve-2025-5086)
2. [Dassault Systèmes — CVE-2025-6204 security advisory](https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204)
3. [Dassault Systèmes — CVE-2025-6205 security advisory](https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205)
4. [CVE record — CVE-2025-5086](https://www.cve.org/CVERecord?id=CVE-2025-5086)
5. [CVE record — CVE-2025-6205](https://www.cve.org/CVERecord?id=CVE-2025-6205)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-5086](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5086)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-6205](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6205)
8. [SANS ISC — Exploit Attempts for Dassault DELMIA Apriso, CVE-2025-5086](https://isc.sans.edu/diary/Exploit+Attempts+for+Dassault+DELMIA+Apriso+CVE20255086/32256)
9. [ProjectDiscovery — Remote Code Execution in DELMIA Apriso](https://projectdiscovery.io/blog/remote-code-execution-in-delmia-apriso)
10. [SecurityWeek — DELMIA factory software vulnerability exploited in attacks](https://www.securityweek.com/delmia-factory-software-vulnerability-exploited-in-attacks/)
11. [SecurityWeek — CISA warns of exploited DELMIA factory software vulnerabilities](https://www.securityweek.com/cisa-warns-of-exploited-delmia-factory-software-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/delmia-apriso-cve-2025-5086-6204-6205-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt