CVE-2025-6204: Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

Patch now

HIGH 8.0EXPLOITEDUPGRADE

CVE-2025-6204 is a high-severity flaw (CVSS 8.0) affecting delmia apriso, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)

A fixed release or distro patch exists.

Risk facts

CVSS score	8.0 (High)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	High
User interaction	None
EPSS exploit chance	79.6% (top 1%)
CISA exploited list	Yes, fix due 2025-11-18
Weakness	CWE-94
Published	2025-08-04
Last modified	2026-06-17

Publisher (CNA): Dassault Systèmes · Vendor: 3ds

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-08-04 10:15 UTCPublished CVE record published
2025-10-28Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-11-18Deadline CISA due date for US federal agencies to patch
2026-06-17 10:01 UTCUpdated Record last modified

3ds delmia apriso UPGRADE

Affected: >= 2020 and <= 2025

Fixed in: newer than 2025

Safe to downgrade to: a release before 2020

1. Check installed version

apt-cache policy delmia-apriso || rpm -q delmia-apriso || delmia-apriso --version

2. UPGRADE to newer than 2025 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade delmia-apriso

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade delmia-apriso

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2020 (Debian / Ubuntu)

apt-cache madison delmia-apriso sudo apt install delmia-apriso=<VERSION_BEFORE_2020> sudo apt-mark hold delmia-apriso

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list delmia-apriso sudo dnf downgrade delmia-apriso-<VERSION_BEFORE_2020> sudo dnf versionlock add delmia-apriso

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · R · FIXED · 4.6.2-1.fc46 · FEDORA-2026-1dd919a262 · source

sudo dnf upgrade --advisory=FEDORA-2026-1dd919a262

Fedora ELN · perl-Mail-AuthenticationResults · FIXED · 2.20261029-1.eln159 · FEDORA-2026-a2c11d7da6 · source

sudo dnf upgrade --advisory=FEDORA-2026-a2c11d7da6

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Nuclei scan template: DELMIA Apriso - Command Injection

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-6204?

delmia apriso: upgrade to newer than 2025. Exact commands for each OS are on this page.

Is CVE-2025-6204 being exploited?

Yes. CVE-2025-6204 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-6204 affect?

CVE-2025-6204 affects delmia apriso. Severity is high (CVSS 8.0). An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

How urgent is CVE-2025-6204?

Priority 78/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV)

Related CVEs

CVE-2025-6205 CRITICAL 9.1 EXPLOITED UPGRADE Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
CVE-2025-5086 CRITICAL 9.0 EXPLOITED UPGRADE Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
CVE-2024-0935 MEDIUM 4.4 UPGRADE Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 thro

References

← Back to latest CVEs