Actively exploited in the wild
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
Dassault Systèmes - DELMIA Apriso · Listed in the CISA KEV since 2025-10-28. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-6204
HighCVSS 8.0KEVSummary
An improper control of code generation (code injection) vulnerability in DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
Risk Assessment
An attacker could exploit this to execute arbitrary code in the context of the application, potentially compromising system and data integrity.
Recommendation
Apply vendor-provided patches for DELMIA Apriso for affected releases.
Other vulnerabilities in DELMIA Apriso
See all- CVE-2026-9695Critical
An Improper Authentication vulnerability in DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.
- CVE-2025-6205CriticalActively exploited
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
- CVE-2025-5086CriticalActively exploited
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Original NVD description (English source)
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.