CISA Warns of Actively Exploited Dassault Systèmes Vulnerabilities: CVE-2025-6205 (CVSS N/A) and CVE-2025-6204 (CVSS N/A)

Estimated reading time: 7 minutes

Key Takeaways:

  • CISA has issued a warning about actively exploited vulnerabilities in Dassault Systèmes’ DELMIA Apriso.
  • The vulnerabilities, CVE-2025-6205 and CVE-2025-6204, pose a significant risk to manufacturing organizations.
  • CISA recommends immediate patching and mitigation to prevent potential exploits.
  • Successful exploitation could lead to unauthorized access, disruption of operations, and supply chain compromise.
  • PurpleOps services can help organizations detect, respond to, and mitigate these threats.

Table of Contents:

  1. Actively Exploited Vulnerabilities in DELMIA Apriso
  2. CISA’s Directive and Recommendations
  3. Impact of DELMIA Apriso Vulnerabilities
  4. Technical Analysis of the Vulnerabilities
  5. Relevance to PurpleOps Services
  6. Actionable Advice
  7. Conclusion
  8. FAQ

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding two actively exploited vulnerabilities in Dassault Systèmes’ DELMIA Apriso. This manufacturing operations management (MOM) and execution (MES) solution is facing critical security flaws that pose a significant risk to organizations, particularly those in manufacturing sectors. CISA’s alert highlights the urgency for immediate patching to mitigate potential exploits.

Actively Exploited Vulnerabilities in DELMIA Apriso

The two vulnerabilities in question are:

  • CVE-2025-6205: A critical severity missing authorization vulnerability that allows unauthenticated attackers to remotely gain privileged access to an unpatched application.
  • CVE-2025-6204: A high-severity code injection vulnerability that allows attackers with high privileges to execute arbitrary code on vulnerable systems.

These vulnerabilities affect DELMIA Apriso from Release 2020 through Release 2025. Dassault Systèmes released patches for these flaws in early August 2025. However, CISA’s recent alert indicates that these vulnerabilities are actively being exploited in the wild, making immediate action crucial.

CISA’s Directive and Recommendations

CISA has added CVE-2025-6205 and CVE-2025-6204 to its Known Exploited Vulnerabilities (KEV) Catalog. As per Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are mandated to secure their networks against these vulnerabilities by November 18, 2025.

While the BOD 22-01 directive is specific to U.S. government agencies, CISA strongly advises all IT administrators and network defenders to prioritize patching these vulnerabilities without delay. The agency emphasizes that these types of vulnerabilities are common attack vectors for malicious cyber actors and present considerable risks.

CISA recommends applying mitigations as per the vendor’s instructions, adhering to BOD 22-01 guidance for cloud services, or discontinuing the use of the product if mitigations are not available.

Impact of DELMIA Apriso Vulnerabilities

Successful exploitation of these vulnerabilities could have severe consequences, especially for organizations relying on DELMIA Apriso for manufacturing operations. DELMIA Apriso is used globally to manage warehouses, schedule production, allocate resources, manage quality, and integrate production equipment with various business applications. It is commonly deployed in automotive, electronics, aerospace, and industrial machinery divisions, where traceability, compliance, and high levels of quality control and process standardization are essential.

The ability for attackers to gain privileged access (CVE-2025-6205) or execute arbitrary code (CVE-2025-6204) could lead to:

  • Unauthorized access to sensitive data: Attackers could steal intellectual property, customer data, or other confidential information.
  • Disruption of manufacturing operations: Attackers could sabotage production processes, leading to delays, financial losses, and reputational damage.
  • Supply chain compromise: By gaining control of DELMIA Apriso, attackers could potentially compromise the entire supply chain, affecting partners and customers.
  • Ransomware attacks: Attackers could encrypt critical systems and demand a ransom for their release, further disrupting operations.

These vulnerabilities underscore the need for organizations to maintain vigilance over their entire technology ecosystem and adopt supply-chain risk monitoring measures.

Technical Analysis of the Vulnerabilities

While the specifics of the exploit methods are not detailed in the CISA alert, the vulnerability descriptions provide some insight:

  • CVE-2025-6205 (Missing Authorization): This likely involves a flaw in the application’s authentication or authorization mechanisms. Attackers could exploit this by bypassing security checks and gaining access to restricted resources or functions without proper credentials.
  • CVE-2025-6204 (Code Injection): This suggests that attackers can inject malicious code into the application, which is then executed by the system. This could be achieved through various means, such as manipulating input fields or exploiting insecure coding practices.

The potential for code injection highlights the importance of secure coding practices and input validation to prevent attackers from introducing malicious code into systems.

Relevance to PurpleOps Services

The actively exploited Dassault Systèmes vulnerabilities have direct relevance to several of PurpleOps’s key service offerings.

  1. Cyber Threat Intelligence Platform: PurpleOps’s cyber threat intelligence platform is designed to provide organizations with up-to-date information on emerging threats, vulnerabilities, and attack vectors. The platform can be used to monitor for exploit activity related to CVE-2025-6205 and CVE-2025-6204, providing early warnings and enabling proactive mitigation. Access to live ransomware API feeds would further enhance the intelligence provided, by giving immediate data points on related ransomware campaigns.
  2. Real-Time Ransomware Intelligence: The potential for ransomware attacks following exploitation of these vulnerabilities highlights the importance of real-time ransomware intelligence. PurpleOps’s services can help organizations identify and respond to ransomware threats, minimizing the impact of a successful attack.
  3. Breach Detection: Should an attacker successfully exploit these vulnerabilities, PurpleOps’s breach detection services can help identify and contain the intrusion. The services leverage advanced monitoring techniques to detect anomalous activity and potential breaches.
  4. Supply-Chain Risk Monitoring: Given the potential for supply chain compromise, PurpleOps’s supply-chain risk monitoring services can assist organizations in assessing and mitigating risks associated with their suppliers and partners who use DELMIA Apriso.
  5. Dark Web Monitoring Service & Underground Forum Intelligence: Monitoring the dark web for discussions and indicators related to the exploitation of these vulnerabilities can provide valuable insights into attacker tactics and potential targets. PurpleOps’s dark web monitoring service and underground forum intelligence capabilities can help organizations stay ahead of emerging threats.
  6. Brand Leak Alerting: Compromised systems may leak sensitive information about an organization’s brand. PurpleOps offers brand leak alerting services to detect and respond to such incidents promptly.

Actionable Advice

For Technical Readers:

  • Immediate Patching: Prioritize patching DELMIA Apriso instances to the latest version to address CVE-2025-6205 and CVE-2025-6204.
  • Implement Strong Access Controls: Enforce strong authentication and authorization mechanisms to prevent unauthorized access.
  • Review Network Segmentation: Implement network segmentation to limit the potential impact of a successful breach.
  • Monitor for Suspicious Activity: Continuously monitor systems for anomalous activity and potential signs of exploitation.
  • Input Validation: Validate all user inputs to prevent code injection attacks.
  • Keep informed on threat intelligence: Ensure that security teams are monitoring reputable threat intelligence feeds for indicators of compromise (IOCs) related to these vulnerabilities.
  • Review and update incident response plans: Incorporate specific response procedures for dealing with potential exploitation of these vulnerabilities.

For Business Leaders:

  • Assess Risk: Evaluate the potential impact of these vulnerabilities on your organization’s operations and data.
  • Prioritize Remediation: Allocate resources to prioritize patching and mitigation efforts.
  • Communicate with Stakeholders: Inform relevant stakeholders, including IT teams, security personnel, and supply chain partners, about the risks and necessary actions.
  • Ensure Business Continuity: Verify that business continuity plans are in place to address potential disruptions caused by successful exploitation.
  • Invest in Threat Intelligence: Subscribe to threat intelligence services to stay informed about emerging threats and vulnerabilities.
  • Regular Security Assessments: Conduct regular security assessments and penetration testing to identify and address vulnerabilities proactively.

Conclusion

The active exploitation of CVE-2025-6205 and CVE-2025-6204 in Dassault Systèmes’ DELMIA Apriso presents a significant cybersecurity risk. Organizations relying on this solution must take immediate action to patch their systems and implement robust security measures. By leveraging PurpleOps’s cyber threat intelligence, breach detection, and supply chain risk monitoring services, organizations can enhance their security posture and mitigate the potential impact of these vulnerabilities.

To learn more about how PurpleOps can help you protect your organization from these and other cyber threats, please visit https://www.purple-ops.io/platform/ or contact us for more information PurpleOps Solutions.

FAQ

Q: What is DELMIA Apriso?
DELMIA Apriso is a manufacturing operations management (MOM) and execution (MES) solution by Dassault Systèmes.

Q: What are CVE-2025-6205 and CVE-2025-6204?
CVE-2025-6205 is a critical missing authorization vulnerability, and CVE-2025-6204 is a high-severity code injection vulnerability in DELMIA Apriso.

Q: What should I do to protect my organization?
Prioritize patching DELMIA Apriso instances, implement strong access controls, monitor for suspicious activity, and review network segmentation.