Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack

Threat actors are actively exploiting multiple flaws behind Dassault Systèmes DELMIA Apriso and XWiki, according to alerts issued by the U.S. Cybersecurity and Infrastructure Security Agency and VulnCheck. The vulnerabilities include CVE-2025-6204 (CVSS 8.0) and CVE-2025-6205 (CVSS 9.1) in DELMIA Apriso, and CVE-2025-24893 (CVSS 9.8) in XWiki, with Dassault Systèmes having addressed the first two in early August and the issues affecting DELMIA Apriso versions from Release 2020 through Release 2025.

VulnCheck notes that CVE-2025-24893 is being abused in a two-stage attack chain that delivers a cryptocurrency miner, with exploitation observed as far back as March 2025 in some reports. In the XWiki case, a guest user could perform arbitrary remote code execution via the /bin/get/Main/SolrSearch endpoint, following an improper neutralisation of input in a dynamic evaluation call.

Abuse IPDB flagged an IP geolocated to Vietnam as active in October 2025, and VulnCheck described a two-pass workflow where a downloader written to disk fetches additional payloads, including a cryptocurrency miner and a blocker for other miners, with remediation deadlines set for U.S. civilian agencies by 18 November 2025.