CVE-2025-6205criticalunder attackCWE-862

CVE-2025-6205: critical vulnerability in Dassault Systèmes DELMIA Apriso

Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

Published · Updated

Follow this CVE+ Monitor DELMIA Apriso

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 67%
from disclosure to weapon
Published on NVDAug 4
CISA KEV+85d
Action required by CISAfederal deadline: 2025-11-18

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

DELMIA Apriso lacks proper permission checks, allowing attackers to gain admin-level access without authorization. This affects all versions from 2020 to 2025 and is a critical security flaw.

Technical detail

A missing authorization control in DELMIA Apriso (2020–2025) permits unauthenticated or low-privileged users to escalate privileges and access restricted functionality. The vulnerability stems from insufficient authorization validation on sensitive operations, enabling privilege escalation attacks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Dassault Systèmes · DELMIA Apriso
Related CVEs — Dassault Systèmes DELMIA Apriso

In the same product, most dangerous first.

CVE-2025-5086CRITICALDeserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 97.2%KEVCVE-2025-6204HIGHImproper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025EPSS 76.6%KEVCVE-2024-3300CRITICALPre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024EPSS 2.9%CVE-2023-2141HIGHUnsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 EPSS 1.0%CVE-2024-3301HIGHPost-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024EPSS 0.7%CVE-2026-9695CRITICALImproper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026EPSS 0.6%