CISA Issues Alert on Active Exploitation of Dassault Systèmes Security Flaws

According to The Cybersecurity and Infrastructure Security Agency (CISA), two critical vulnerabilities have been identified in Dassault Systèmes DELMIA Apriso, a manufacturing execution system. The flaws are CVE-2025-6204 (Code Injection, CWE-94) and CVE-2025-6205 (Missing Authorization, CWE-862), both rated Critical, with attack vectors that could allow arbitrary code execution and bypass of security controls.

CISA has added these flaws to its Known Exploited Vulnerabilities Catalog, signalling active concern about exploitation in the wild. The agency notes that DELMIA Apriso is deployed across manufacturing facilities worldwide and warns that an attacker successfully exploiting these issues could access sensitive manufacturing processes, intellectual property, and production schedules, potentially leading to data theft, disruption, or production shutdowns.

Remediation is required with a deadline of 18 November 2025; organisations should inventory affected systems and apply patches and mitigations released by Dassault Systèmes, with additional protections for cloud deployments in line with BOD 22-01 guidance.