Historical catalog analysis: CISA added this entry on October 28, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-6204 is a code injection vulnerability (CWE-94) identified in Dassault Systèmes DELMIA Apriso. This flaw could allow an attacker to execute arbitrary code on the system hosting the software.
Exposure and applicability
This vulnerability affects organizations utilizing DELMIA Apriso as their Manufacturing Execution System (MES). Because MES platforms serve as the critical integration layer between high-level enterprise resource planning (ERP) and the physical control systems on the shop floor, a compromise at this level could potentially impact the integrity of production data and operational orchestration.
Asset owners should consult the Dassault Systèmes trust center to determine if their specific version of DELMIA Apriso is affected.
Remediation priorities
Based on our analysis, OT security leaders and plant managers should prioritize the following actions:
- Version Verification: Identify all instances of DELMIA Apriso across the production environment to determine applicability. This is a prerequisite for any remediation effort.
- Vendor Mitigation Deployment: Apply the specific mitigations or patches provided by Dassault Systèmes via their security advisory.
- Access Control Review: While patching addresses the root cause, restricting network access to the MES server to only authorized users and systems could reduce the likelihood of an attacker reaching the vulnerable interface.
- Service Evaluation: In scenarios where mitigations are unavailable or cannot be applied due to operational constraints, organizations should evaluate whether to discontinue use of the affected product components to eliminate the risk.
How to validate remediation
To verify that exposure has been reduced, administrators should:
* Confirm the installation of vendor-supplied patches by verifying the current software build version against the vendor’s fixed-version list.
* Review system logs for unauthorized attempts to execute code or unusual process behavior on the MES server.
* Validate that network segmentation rules are active and restricting traffic to the MES environment according to the principle of least privilege.
Limits and open questions
It remains unknown whether this vulnerability has been exploited by ransomware campaigns. Additionally, while CISA has established a remediation deadline of November 18, 2025, for federal agencies, this date is not a mandatory requirement for private sector organizations, though it serves as a benchmark for urgency.
Users should note that applying patches to MES software may require coordinated downtime with production schedules to avoid disrupting active manufacturing processes.
Source and editorial note
CVE-2025-6204: Dassault Systèmes DELMIA Apriso Code Injection Vulnerability · Source date: October 28, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: October 31, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 12, 2026 at 01:26 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗