✨ The Containment Era is here. →Explore ✨

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In June 2025, Dassault Systèmes disclosed a critical deserialization vulnerability (CVE-2025-5086) in its DELMIA Apriso Manufacturing Operation Management system, affecting releases from 2020 through 2025. Attackers exploited this remote code execution flaw via crafted SOAP requests containing malicious serialized data, enabling them to upload and execute arbitrary Windows executables on vulnerable servers. The exploit activity, orchestrated through automated scanners—some associated with the Project Discovery framework—originated from multiple geographies and targeted the core manufacturing process integration point, posing risks to operational uptime and potential lateral movement within enterprise environments.

This incident underscores the growing threat targeting industrial control applications and critical infrastructure through software supply chain vulnerabilities. Exploiting deserialization bugs in widely deployed operational technology platforms has become a preferred method for threat actors, highlighting the urgent need for timely patching, application-layer anomaly detection, and zero trust segmentation within manufacturing and industrial settings.

Why This Matters Now

Attackers are increasingly focusing on software vulnerabilities in industrial operations platforms, leveraging remote code execution to move laterally and disrupt core manufacturing services. As exploit attempts for CVE-2025-5086 have begun surfacing in the wild—and with many environments slow to patch—manufacturers face heightened risk of business disruption, data exfiltration, and potential regulatory impact if these vulnerabilities remain unmitigated.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The incident highlighted deficiencies in secure software development, timely vulnerability patching, east-west segmentation, and lack of anomaly detection across manufacturing IT/OT environments.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Zero Trust segmentation, robust east-west controls, inline IPS, centralized visibility, and egress policy enforcement could have greatly limited the adversary's ability to move laterally, execute code, establish command & control, and exfiltrate data at multiple kill chain stages. Enforcement of these CNSF controls would segment workloads, restrict exploit paths, and enable rapid detection and containment of malicious actions.

Initial Compromise

Control: Inline IPS (Suricata)

Mitigation: Attack blocked at network perimeter or micro-perimeter based on exploit signatures or malformed traffic.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Containment of threat by limiting compromised workload’s access to other systems and privileges.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Malicious lateral movement attempts are prevented or promptly detected.

Command & Control

Control: Egress Security & Policy Enforcement

Mitigation: Unapproved outbound connections denied or flagged for investigation.

Exfiltration

Control: Multicloud Visibility & Control

Mitigation: Detection and prevention of unauthorized data exfiltration events.

Impact (Mitigations)

Rapid detection and containment of destructive or unusual behaviors.

Impact at a Glance

Affected Business Functions

  • Manufacturing Operations
  • Supply Chain Management
  • Production Planning
Operational Disruption

Estimated downtime: 5 days

Financial Impact

Estimated loss: $1,500,000

Data Exposure

Potential exposure of sensitive manufacturing data, including proprietary production processes and supply chain information.

Recommended Actions

  • • Deploy inline IPS and cloud firewall controls at workload ingress points to detect and block exploit attempts such as SOAP deserialization attacks.
  • • Enforce zero trust segmentation and least privilege across application and network layers to prevent lateral movement and privilege escalation from compromised systems.
  • • Establish egress filtering and outbound policy enforcement to block unauthorized command & control and exfiltration channels.
  • • Enable robust monitoring, traffic observability, and threat anomaly detection to catch policy violations and malicious activities early.
  • • Regularly validate and update vulnerable applications, while integrating CNSF controls into DevOps and cloud migration practices for proactive protection.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image