CISA KEV Alert: Critical DELMIA Apriso Flaws Under Active Exploitation Allow RCE and Privileged Access

The Cybersecurity and Infrastructure Security Agency (CISA) has added two critical DELMIA Apriso vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after confirmed evidence of active exploitation in the wild. The flaws, CVE-2025-6204 and CVE-2025-6205, affect DELMIA Apriso releases from 2020 through 2025 and could allow a remote attacker to execute arbitrary code or gain unauthorized privileged access to manufacturing management environments.

CVE-2025-6204 is rated CVSS 8.0 (High) and stems from improper control of code generation within DELMIA Apriso’s backend components, while CVE-2025-6205 is rated Critical (CVSS 9.1) and involves missing authorization controls that could permit privileged access to the application.

According to Dassault Systèmes’ own security bulletin, the code injection vulnerability could allow an attacker to execute arbitrary code, and lack of proper access validation could enable administrative actions such as modifying configuration files or extracting sensitive data. CISA warned these vulnerabilities pose significant risk to the federal enterprise and directed Federal Civilian Executive Branch agencies to apply mitigations or patches no later than 18 November 2025.