CVE-2025-6204highunder attackCWE-94

CVE-2025-6204: high-severity vulnerability in Dassault Systèmes DELMIA Apriso

Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

Published · Updated

Follow this CVE+ Monitor DELMIA Apriso

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8epss 77%
from disclosure to weapon
Published on NVDAug 4
CISA KEV+85d
Action required by CISAfederal deadline: 2025-11-18

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

DELMIA Apriso contains a code injection flaw that lets attackers run malicious code on affected systems. This vulnerability affects versions from 2020 through 2025 and poses a serious risk to manufacturing operations that rely on this software.

Technical detail

An Improper Control of Generation of Code (CWE-94) vulnerability in DELMIA Apriso releases 2020–2025 allows attackers to inject and execute arbitrary code through inadequate input validation or code generation controls. The attack vector and required privileges are not specified, but successful exploitation results in arbitrary code execution with potential impact to system confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Dassault Systèmes · DELMIA Apriso
Related CVEs — Dassault Systèmes DELMIA Apriso

In the same product, most dangerous first.

CVE-2025-5086CRITICALDeserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 97.2%KEVCVE-2025-6205CRITICALMissing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 67.2%KEVCVE-2024-3300CRITICALPre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024EPSS 2.9%CVE-2023-2141HIGHUnsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 EPSS 1.0%CVE-2024-3301HIGHPost-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024EPSS 0.7%CVE-2026-9695CRITICALImproper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026EPSS 0.6%