CVE Alert: CVE-2025-6204 – Dassault Systèmes – DELMIA Apriso

Risk verdict

Critical risk with active exploitation; treat as priority 1 due to remote code execution potential requiring high privileges.

Why this matters

An attacker with admin credentials or a foothold in the network could remotely inject code on affected servers, compromising the MES environment. The impact spans confidentiality, integrity and availability, with potential production disruption and data exposure across the organisation’s manufacturing footprint.

Most likely attack path

Exploitation is network-based and preconditions include high privileges and no user interaction. An adversary with admin access could trigger the code-generation path to execute arbitrary payloads, potentially enabling lateral movement within scope and affecting connected components.

Who is most exposed

On-premises or hybrid DELMIA Apriso deployments with exposed admin interfaces and network access to MES services are most at risk; those with central servers shared across sites and integrations to ERP/SCADA networks are especially vulnerable.

Detection ideas

• Unauthorised or anomalous code-generation activity on the Apriso server.
• New or modified binaries/scripts in the code-generation path.
• Privilege escalation attempts or unusual admin activity around MES services.
• Unusual outbound network connections from Apriso hosts.
• Correlated security events: admin logins followed by atypical job executions or code injections.

Mitigation and prioritisation

• Apply vendor patch/update to the latest supported release; verify in staging before production.
• Enforce least-privilege access, MFA for admins, and restrict network exposure to Apriso endpoints; implement network segmentation.
• Strengthen monitoring: enable detailed logging for code-generation components, deploy EDR/whitelisting, and alert on anomalous code-generation activity.
• Review and harden change-management processes; schedule patch window and coordinate with IT/OT teams.
• Treat as priority 1 given KEV/exploitation activity and high-severity CVSS context.