Dassault Systèmes flaws being used in attacks

CISA lists 3 flaws in Dassault Systèmes products as being used in attacks, most recently on 28 Oct 2025.

What to do

1. Update every Dassault Systèmes product you use.Install the updates Dassault Systèmes offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 28 Oct 2025
   Dassault Systèmes DELMIA Apriso
   CVE-2025-6205Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
   Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 28 Oct 2025
   Dassault Systèmes DELMIA Apriso
   CVE-2025-6204Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
   Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 11 Sep 2025
   Dassault Systèmes DELMIA Apriso
   CVE-2025-5086Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability
   Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Dassault Systèmes on CISA’s site.