VulnerabilityAnalyzed

CVE-2025-6204

Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

KEVHIGH 8.0EPSS 77.3%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 18 November 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

CVSS 3.1: 8.0 HIGHCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 77.32% probability · 100th percentile
CISA KEV: Listed 28 October 2025 · due 18 November 2025
Weakness: CWE-94
Affected: 3ds/delmia apriso
Source: 3DS.Information-Security@3ds.com

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6204

References

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6204US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.