CVE-2026-9695: DELMIA Apriso Auth Bypass Vulnerability

CVE-2026-9695 Overview

CVE-2026-9695 is an improper authentication vulnerability [CWE-287] affecting Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2026. The flaw allows a remote, unauthenticated attacker to gain privileged access to the server over the network. DELMIA Apriso is a Manufacturing Operations Management (MOM) platform used to orchestrate production, warehouse, and quality processes in industrial environments. Successful exploitation compromises confidentiality, integrity, and availability of the affected server and any manufacturing operations it controls.

Critical Impact
Unauthenticated network attackers can obtain privileged access to DELMIA Apriso servers across all supported releases (2020–2026), enabling full compromise of manufacturing operations data and processes.

Affected Products

DELMIA Apriso Release 2020
DELMIA Apriso Releases 2021 through 2025
DELMIA Apriso Release 2026

Discovery Timeline

2026-07-08 - CVE-2026-9695 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-9695

Vulnerability Analysis

CVE-2026-9695 is classified as an Improper Authentication weakness [CWE-287]. The DELMIA Apriso server fails to correctly verify the identity of a requester before granting privileged operations. An attacker who reaches the application over the network can bypass authentication controls and interact with the server as a privileged user.

Because DELMIA Apriso serves as the operational backbone for manufacturing execution, privileged access exposes production schedules, work instructions, quality records, and integration interfaces to shop-floor equipment and enterprise resource planning (ERP) systems. An attacker can read sensitive production data, alter manufacturing workflows, or disrupt operations.

The attack requires no user interaction and no prior credentials. Any DELMIA Apriso instance reachable from an attacker-controlled network position is at risk, including deployments exposed through misconfigured firewalls, VPN gateways, or shared operational technology (OT) networks.

Root Cause

The root cause is an authentication flaw in DELMIA Apriso that allows requests to reach privileged functionality without proper identity verification. Dassault Systèmes has not published the specific implementation details in the public advisory. Refer to the 3DS Security Advisory CVE-2026-9695 for vendor-supplied technical details.

Attack Vector

The attack vector is network-based with low complexity. An unauthenticated attacker sends crafted requests to the exposed DELMIA Apriso service and obtains privileged access without user interaction. In manufacturing environments where Apriso servers straddle IT and OT networks, exploitation can pivot from the corporate network into production systems.

No public proof-of-concept exploit or exploitation-in-the-wild has been confirmed at the time of publication.

Detection Methods for CVE-2026-9695

Indicators of Compromise

Successful authentication events on DELMIA Apriso from unexpected source IP addresses, particularly outside the manufacturing operations network.
Privileged administrative actions in Apriso audit logs that do not correlate to known operator sessions or change tickets.
Anomalous configuration, workflow, or user-account changes within DELMIA Apriso occurring outside maintenance windows.
Unexpected outbound connections from the Apriso server to unknown external hosts following inbound HTTP/HTTPS traffic.

Detection Strategies

Enable verbose authentication and authorization logging in DELMIA Apriso and forward events to a centralized SIEM for correlation.
Baseline normal API and web request patterns to the Apriso server and alert on deviations, particularly bursts of authentication attempts followed by privileged actions.
Deploy network detection rules on ingress paths to Apriso that flag requests from non-approved subnets.

Monitoring Recommendations

Continuously monitor DELMIA Apriso admin accounts and role changes, alerting on any new privileged user creation.
Track process execution and file changes on the underlying Apriso server host for signs of post-exploitation activity.
Correlate Apriso authentication logs with identity provider logs to detect sessions that lack a corresponding upstream authentication event.

How to Mitigate CVE-2026-9695

Immediate Actions Required

Apply the security update referenced in the 3DS Security Advisory CVE-2026-9695 to all DELMIA Apriso instances from Release 2020 through Release 2026.
Remove any direct internet exposure of DELMIA Apriso web and API endpoints and restrict access to a defined administrative network segment.
Rotate credentials, API keys, and service-account secrets used by or stored within Apriso after patching.
Review Apriso audit logs from before the patch date for evidence of unauthorized privileged access.

Patch Information

Dassault Systèmes has published guidance for CVE-2026-9695 in its security advisory. Consult the 3DS Security Advisory CVE-2026-9695 for the fixed release versions, hotfixes, and upgrade paths applicable to each supported DELMIA Apriso release.

Workarounds

Place DELMIA Apriso behind a reverse proxy or web application firewall (WAF) that enforces strong authentication before requests reach the application.
Restrict network access to the Apriso server using firewall rules, allowing only approved management stations and integrated systems.
Enforce network segmentation between IT and OT zones so that a compromised Apriso instance cannot reach unrelated production assets.
Disable or block any Apriso interfaces that are not required for business operations until the patch is applied.

bash

# Example: restrict inbound access to DELMIA Apriso to an admin subnet only
# Replace 10.20.30.0/24 with your approved management network
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP