CVE-2025-6205 Dassault Systèmes DELMIA Apriso Missing Authorization
An attacker can gain privileged access to DELMIA Apriso due to missing authorization checks, requiring vendor patches.
- Exploited in the wild
- Since 28 Oct 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6205?
CVE-2025-6205 is a critical missing authorization vulnerability in Dassault Systèmes DELMIA Apriso, published on 4 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
Weakness: CWE-862
Which versions are affected by CVE-2025-6205?
It affects 1 product.
Products include 3ds Delmia Apriso.
How do I fix CVE-2025-6205?
No fix has been published for CVE-2025-6205 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 18 Nov 2025.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-6205 being exploited?
Yes. Attackers have exploited CVE-2025-6205 in the wild since at least 28 Oct 2025.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Dassault Systèmes DELMIA Apriso
- CVE-2025-5086 Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data
- CVE-2025-6204 Dassault Systèmes DELMIA Apriso Code Injection
- CVE-2023-2141 Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022
- CVE-2023-2140 Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
- CVE-2023-2139 Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
Sources
Also known as GHSA-7pcv-gm7q-mj69.