CVE-2025-6204

What it actually does

CVE-2025-6204 is a code-injection flaw in Dassault Systèmes DELMIA Apriso Release 2020 through Release 2025. Improper control over generated code can allow an attacker to cause the application to create or execute attacker-controlled instructions, resulting in arbitrary code execution on the Apriso application server. Successful exploitation may give the attacker the privileges of the Apriso application or web service account and can be used to run operating-system commands, deploy web shells or malware, access Apriso data and integrations, and pivot to connected manufacturing, ERP, database, or identity systems.

Why it matters to the business

This vulnerability affects a manufacturing operations platform, so compromise can lead to theft or manipulation of production data, disruption of plant-floor workflows, tampering with manufacturing execution processes, and broader enterprise intrusion through connected systems. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, making remediation urgent; organizations subject to CISA timelines should address it by the 2025-11-18 due date. Even without confirmed ransomware use, remote code execution in a production application can enable outage, data loss, fraud, and lateral movement into operational technology-adjacent environments.

How an attack unfolds

An attacker first identifies an internet-exposed or internally reachable DELMIA Apriso instance running an affected release. They then send crafted input to a vulnerable Apriso function that influences code generation or evaluation. Because the application does not properly constrain generated code, the malicious input is interpreted as executable code rather than data. The attacker uses this execution primitive to run commands under the Apriso service context, commonly to perform reconnaissance, write a web shell or loader, retrieve additional tooling, dump credentials or configuration secrets, and move laterally to databases, file shares, identity services, or manufacturing systems integrated with Apriso. Public reporting and CISA KEV status indicate active exploitation against Dassault Systèmes DELMIA Apriso code-injection exposure, so defenders should assume scanning and opportunistic exploitation are plausible.

How to fix it

Upgrade DELMIA Apriso to a vendor-supported fixed release or apply the applicable Dassault Systèmes security update/hotfix as soon as it is available for the deployed Apriso release. Because the provided advisory data does not include exact fixed versions, administrators should verify the current Dassault Systèmes advisory and support portal for the precise remediation package for Release 2020 through Release 2025. Until patched, restrict Apriso access to trusted networks and authenticated users, remove direct internet exposure, enforce VPN or zero-trust access controls, and limit administrative endpoints. Harden the Apriso service account with least privilege, rotate credentials stored in Apriso configuration after patching, restrict outbound network access from Apriso servers, and monitor or block suspicious child-process execution from web/application server processes. If exploitation is suspected, rebuild affected application servers from trusted media, rotate related credentials and certificates, and review downstream database and integration systems for compromise.

How to confirm the fix worked

Confirm the installed DELMIA Apriso release and patch level against the latest Dassault Systèmes security advisory for CVE-2025-6204. Validate that all Apriso application nodes, web nodes, background workers, and disaster-recovery images are updated, not only the primary server. Re-run authenticated vulnerability scans or vendor-provided validation checks after patching. Confirm that Apriso is not directly exposed to the internet unless explicitly required and protected by strong access controls. Review endpoint telemetry to ensure Apriso or web server processes are not spawning command shells, scripting engines, file-transfer tools, or unknown binaries. If compensating controls are used, test that untrusted networks cannot reach the vulnerable application paths and that outbound callbacks from Apriso servers are blocked or alerted.

Typical attack path

1. Discover a DELMIA Apriso instance through internet scanning, exposed portals, VPN access, or internal reconnaissance.
2. Fingerprint the Apriso release or behavior to determine whether it falls within Release 2020 through Release 2025.
3. Send crafted input to the vulnerable code-generation path to cause attacker-controlled code to be generated or executed.
4. Validate command execution using a low-noise command such as hostname, whoami, or DNS/HTTP callback.
5. Establish persistence by uploading a web shell, scheduled task, service, script, or secondary payload.
6. Enumerate application configuration, database connection strings, credentials, service accounts, and integrated manufacturing or ERP systems.
7. Exfiltrate data, alter production-related records, or pivot laterally using harvested credentials and trusted Apriso integrations.
8. Cover tracks by deleting application logs, web server logs, dropped files, command history, or endpoint telemetry.

How to detect it

Look for evidence that the Apriso application or its hosting web server executed unexpected commands, wrote new executable files, or made unusual outbound connections. Useful log sources include Apriso application logs, IIS or web server access logs, reverse-proxy and WAF logs, Windows Security Event ID 4688 process creation logs, PowerShell Operational logs, Sysmon events, EDR process trees, file-creation telemetry, DNS logs, proxy logs, firewall egress logs, and database audit logs. Prioritize review around suspicious requests followed by child processes from w3wp.exe, java.exe, dotnet.exe, Apriso services, or other application-hosting processes. Investigate requests containing code-like metacharacters, encoded payloads, template/script syntax, command separators, or attempts to invoke operating-system utilities. Hunt for new or modified ASPX, DLL, EXE, PS1, BAT, VBS, JS, or archive files in Apriso web roots, upload directories, temporary directories, and service working directories. Because active exploitation has been reported, also review for post-exploitation activity such as credential dumping, discovery commands, abnormal database queries, archive creation, and outbound connections to rare domains or IPs.

• ParentImage:*\\w3wp.exe AND Image:*\\cmd.exe
• ParentImage:*\\w3wp.exe AND Image:*\\powershell.exe
• ParentImage:*\\w3wp.exe AND Image:*\\pwsh.exe
• ParentImage:*\\w3wp.exe AND Image:*\\certutil.exe
• ParentImage:*\\w3wp.exe AND Image:*\\curl.exe
• ParentImage:*\\w3wp.exe AND Image:*\\wget.exe
• ParentImage:*\\w3wp.exe AND Image:*\\mshta.exe
• ParentImage:*\\w3wp.exe AND Image:*\\rundll32.exe
• ParentImage:*\\w3wp.exe AND Image:*\\regsvr32.exe
• ParentImage:*\\w3wp.exe AND CommandLine:*whoami*
• ParentImage:*\\w3wp.exe AND CommandLine:*hostname*
• ParentImage:*\\w3wp.exe AND CommandLine:*ipconfig*
• ParentImage:*\\w3wp.exe AND CommandLine:*net user*
• ParentImage:*\\w3wp.exe AND CommandLine:*nltest*
• ParentImage:*\\w3wp.exe AND CommandLine:*powershell -enc*
• ParentImage:*\\w3wp.exe AND CommandLine:*-EncodedCommand*
• CommandLine:*certutil* -urlcache *
• CommandLine:*bitsadmin* /transfer *
• CommandLine:*Invoke-WebRequest*
• CommandLine:*IEX*
• CommandLine:*FromBase64String*
• CommandLine:*System.Net.WebClient*
• *.aspx created in Apriso web directory
• *.ashx created in Apriso web directory
• *.ps1 created under Apriso application directory
• *.bat created under Apriso application directory
• *.exe created under Apriso application directory
• Apriso application server outbound connection to rare external IP
• Apriso application server DNS query to newly observed domain
• HTTP request containing ;cmd=
• HTTP request containing powershell
• HTTP request containing /bin/sh
• HTTP request containing ${
• HTTP request containing <%
• HTTP request containing %3c%25
• HTTP request containing Runtime.getRuntime
• HTTP request containing ProcessBuilder
• HTTP request containing FromBase64String

What your security team should do

• Treat this as a priority-one remediation item because it is in CISA KEV, has active exploitation, and has a high EPSS likelihood of exploitation.
• Inventory all DELMIA Apriso deployments, including production, staging, disaster-recovery, vendor-managed, and plant-local instances.
• Obtain and apply the Dassault Systèmes fixed release or hotfix for each affected Apriso release; track completion against the 2025-11-18 KEV deadline where applicable.
• Immediately restrict network access to Apriso from the internet and untrusted internal segments until all instances are confirmed fixed.
• Enable or tune detections for web/application server processes spawning cmd.exe, powershell.exe, certutil.exe, curl, wget, mshta.exe, rundll32.exe, regsvr32.exe, or unknown executables.
• Hunt for signs of prior compromise in Apriso application logs, IIS or reverse-proxy logs, Windows process creation logs, EDR telemetry, file-system changes, and outbound DNS/HTTP connections.
• Rotate Apriso service account credentials, database credentials, API keys, and integration secrets after patching if there is any indication of exploitation or if exposure was internet-facing.
• Review connected database, ERP, MES, identity, file-share, and OT-adjacent integrations for lateral movement from Apriso servers.
• Preserve forensic evidence before rebuilding or cleaning suspected compromised systems.
• Add Apriso assets to continuous external attack-surface monitoring and internal vulnerability management reporting.