DELMIA Apriso Code Injection (CVE-2025-6204)

Historical catalog analysis: CISA added this entry on October 28, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-6204 is a code injection vulnerability (CWE-94) identified in Dassault Systèmes DELMIA Apriso. This flaw could allow an attacker to execute arbitrary code on the affected system, potentially leading to full system compromise depending on the privileges of the application process.

Exposure and applicability

This vulnerability applies to environments deploying DELMIA Apriso. Organizations utilizing this software for manufacturing operations management should identify all instances—including on-premises installations and cloud-based deployments—to determine their exposure level. Because code injection often involves the processing of untrusted input, assets exposed to external networks or those handling data from unverified sources are at higher risk.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize actions in the following order:

1. Vendor Mitigation Deployment: The primary objective is to apply the specific mitigations provided by Dassault Systèmes. This is the most direct method to address the underlying code injection flaw.
2. Cloud Service Alignment: For organizations using cloud-hosted versions of the product, remediation should align with BOD 22-01 guidance to ensure that service providers have addressed the exposure in the shared responsibility model.
3. Risk Elimination: In scenarios where vendor mitigations are unavailable or cannot be applied due to legacy constraints, the only way to fully eliminate the risk is to discontinue use of the affected product.

How to validate remediation

Verification must go beyond a simple version check, as a deployed patch does not always guarantee that the vulnerability is neutralized in a specific environment. We recommend the following validation approach:

• Configuration Audit: Verify that all vendor-prescribed configuration changes or patches have been applied across all nodes of the DELMIA Apriso deployment.
• Functional Testing: In a non-production environment, security teams should verify that the application still functions as intended after mitigations are applied to ensure no operational regression occurred during the remediation process.
• Exposure Confirmation: Confirm through network mapping that the affected service is not unnecessarily exposed to untrusted networks, reducing the attack surface while the fix is being validated.

Limits and open questions

It remains unknown whether this vulnerability has been leveraged in active ransomware campaigns. Furthermore, the source does not provide specific details on the exact input vector used for the injection or the prerequisites required for successful exploitation. Consequently, there is a residual risk that compensating controls (such as WAFs or IPS) may be bypassed if they are not tuned to the specific patterns of this code injection flaw. Defenders should rely on vendor-supported fixes rather than perimeter defenses alone.

Source and editorial note

CVE-2025-6204: Dassault Systèmes DELMIA Apriso Code Injection Vulnerability · Source date: October 28, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: October 31, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 30, 2026 at 00:09 UTC.

Request a Vulnerability Assessment