U.S. CISA adds Dassault Systèmes DELMIA Apriso flaws to its Known Exploited Vulnerabilities catalog

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Dassault Systèmes DELMIA Apriso flaws to its Known Exploited Vulnerabilities catalog. The two CVEs are CVE-2025-6204, a code injection vulnerability with a CVSS score of 8.0, and CVE-2025-6205, a missing authorization vulnerability with a CVSS score of 9.1; both affect DELMIA Apriso releases from 2020 through 2025.

CISA notes that exploitation could allow an attacker to execute arbitrary code or gain privileged access to the application. Agencies are required to address the identified flaws by the due date to protect networks against attacks exploiting the KEV catalog, with CISA ordering federal agencies to fix the vulnerabilities by 18 November 2025.

The article also recalls that, in September, CISA added another DELMIA Apriso flaw, CVE-2025-5086, to the KEV catalog, with a CVSS score of 9.0, describing it as a deserialization of untrusted data issue.