CISA Warns of Exploited DELMIA Factory Software Vulnerabilities

According to SecurityWeek, the US Cybersecurity and Infrastructure Security Agency (CISA) has warned that two recent vulnerabilities in DELMIA Apriso factory software have been exploited in attacks. The flaws, CVE-2025-6204 and CVE-2025-6205, affect DELMIA Apriso from release 2020 through release 2025, with CVSS scores of 8.0 and 9.1 respectively; CVE-2025-6204 is a code injection bug and CVE-2025-6205 a missing authorisation issue that can enable privileged access and remote code execution.

ProjectDiscovery notes that the two defects can be chained to create elevated-privilege accounts and place executables into a web-served directory, aided by a SOAP endpoint and a post-authentication file upload API in the product. Dassault Systèmes released patches and advisories on 4 August, and ProjectDiscovery published technical details on 23 September; now CISA has added the issues to its Known Exploited Vulnerabilities list.

CISA urges federal agencies to patch within three weeks under BOD 22-01, and organisations are advised to review the KEV list and apply the described mitigations. To hunt for compromises, organisations should look for newly created privileged accounts and scan for executables such as webshells, with last month’s warning noting another DELMIA Apriso vulnerability (CVE-2025-5086).