October 28, 2025 · Applied Cybernetics Group
CVE-2025-6204 — Dassault Systèmes DELMIA Apriso
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
- Added to KEV
2025-10-28- Federal due date
2025-11-18- Vendor
- Dassault Systèmes
- Product
- DELMIA Apriso
- EPSS
- 99.5th percentile (score 0.761, as of
2026-07-13) - NVD CVSS v3.1
- 8 (HIGH)
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2025-6204
CISA short description
Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
NVD description
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.