CISA warns of actively exploited flaws in Dassault DELMIA Apriso manufacturing software
Take action: If you're using Dassault Systèmes DELMIA Apriso manufacturing software (Release 2020 through 2025), make sure these systems are isolated from the internet and untrusted networks. Then plan a quick patch to versions released in August 2025 and educate your administrators on phishing and malware risks.
Learn More
CISA has issued a warning that threat actors are actively exploiting two vulnerabilities in Dassault Systèmes' DELMIA Apriso manufacturing operations management (MOM) and manufacturing execution system (MES) software.
Vulnerabilities summary
- CVE-2025-6205 (CVSS score 9.1), a missing authorization vulnerability that allows unauthenticated threat actors to remotely gain privileged access to unpatched DELMIA Apriso applications.
- CVE-2025-6204 (CVSS score 8.0) an improper control of code generation vulnerability that allows attackers who already possess high-level privileges to execute arbitrary code on vulnerable systems. This vulnerability requires the attacker to have pre-existing elevated access.
The flaws affect DELMIA Apriso installations across multiple release versions, from Release 2020 through Release 2025.
Dassault Systèmes patched both vulnerabilities in early August 2025. Organizations running any version within this range are vulnerable to exploitation and should prioritize patching and isolate the systems from untrusted networks.
