# CVE-2025-6205: Dassault Systèmes DELMIA Apriso missing authorization

Source: https://junglewise.ai/threats/cve-2025-6205-dassault-systemes-delmia-apriso-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-28. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-6205 · Severity: critical · CVSS 9.1 · Exploited in the wild · Published 2025-10-28

Dassault Systèmes DELMIA Apriso, a manufacturing operations management software used to manage global production processes, contains a critical security flaw. This vulnerability allows an unauthorized person to bypass security checks and gain high-level administrative access to the application over the network. This could lead to the theft of sensitive manufacturing data, disruption of production lines, or unauthorized changes to operational workflows. This issue is reportedly being exploited in the wild.

Technologies: [Dassault SystèMes DELMIA Apriso](https://junglewise.ai/threats/technologies/delmia-apriso). Vendors: [Dassault SystèMes](https://junglewise.ai/threats/vendors/dassault-syst-mes).

## Quick answers

**Is CVE-2025-6205 exploited in the wild?** Yes. CVE-2025-6205 is known to be exploited in the wild, first recorded on 28 October 2025. Treat it as urgent.

**How severe is CVE-2025-6205?** Critical severity, with a CVSS score of 9.1, published 28 October 2025.

**Which products and versions are affected?** Dassault Systèmes DELMIA Apriso Release 2020 through Release 2025.

**Is there a fix for CVE-2025-6205?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-6205 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-6205?** Check whether you run Dassault SystèMes DELMIA Apriso. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in Dassault Systèmes DELMIA Apriso from Release 2020 through Release 2025. The flaw allows a remote, unauthenticated attacker to bypass authorization mechanisms due to insufficient validation of user permissions. By exploiting this, an attacker can gain privileged access to the application's administrative functions and sensitive data. The vulnerability has a CVSS score of 9.1 and is confirmed by CISA to be under active exploitation. Users are advised to apply vendor-provided mitigations or patches immediately.

## Affected products

- Dassault Systèmes DELMIA Apriso Release 2020 through Release 2025

## Timeline

- 2025-08-04: disclosed: Initial CVE publication
- 2025-10-28: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-10-28: advisory: Vendor advisory updated

## Related threats

- [Dassault Systèmes DELMIA Apriso code injection](https://junglewise.ai/threats/cve-2025-6204-dassault-systemes-delmia-apriso-code-injection)
- [Dassault Systèmes DELMIA Apriso deserialization remote code execution](https://junglewise.ai/threats/cve-2025-5086-dassault-systemes-delmia-apriso-deserialization-remote-code)