The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, warning that attackers are actively exploiting them in the wild. The newly listed vulnerabilities-both found in Dassault Systèmes’ DELMIA Apriso manufacturing software-highlight an urgent need for organizations using the platform to patch immediately.
According to CISA, the affected flaws include CVE-2025-6204, a code injection vulnerability, and CVE-2025-6205, a missing authorization vulnerability. These issues, CISA warns, “pose significant risks to the federal enterprise” and are among the most common entry points for cyberattacks targeting industrial systems.
The vulnerabilities were identified as part of CISA’s ongoing effort to track and mitigate actively exploited software weaknesses through its Binding Operational Directive (BOD) 22-01 program. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies patch known exploited vulnerabilities within a set timeframe to minimize risk to federal networks.
While the directive is legally binding for U.S. federal agencies, CISA strongly advises all organizations-public and private alike-to prioritize patching these vulnerabilities as part of a broader vulnerability management program.
These two flaws in Dassault Systèmes DELMIA Apriso, a software widely used in manufacturing, logistics, and supply chain management, could allow attackers to inject malicious code or bypass authorization controls. Successful exploitation may enable threat actors to manipulate production systems, steal sensitive industrial data, or disrupt critical manufacturing processes-posing serious risks to operational continuity.
Given that industrial and manufacturing systems are integral to critical infrastructure sectors such as energy, transport, and defense, the exploitation of these vulnerabilities could have ripple effects beyond any single organization.
MEA Context:
For enterprises across the Middle East and Africa, where digital transformation in manufacturing and logistics is accelerating, this alert serves as a wake-up call. Many regional industries rely on software like DELMIA Apriso for automation and supply chain optimization. An unpatched vulnerability in these systems could expose factories, logistics hubs, or even government projects to cyber sabotage or ransomware attacks—making proactive patching and awareness training essential.
10 Recommended Actions for Security Teams:
- Patch Immediately: Apply all available updates from Dassault Systèmes for DELMIA Apriso software.
- Check CISA’s KEV Catalog: Regularly review the Known Exploited Vulnerabilities list.
- Restrict Access: Limit network exposure of manufacturing or operational technology (OT) systems.
- Monitor for Indicators of Compromise (IoCs): Look for suspicious changes, code injections, or unauthorized access attempts.
- Review Privileges: Enforce the principle of least privilege for all DELMIA Apriso users and service accounts.
- Network Segmentation: Separate OT and IT networks to reduce lateral movement opportunities.
- Deploy Endpoint Protection: Use advanced endpoint detection solutions such as those recommended by Saintynet Cybersecurity.
- Enhance User Awareness: Train staff to recognize phishing or social engineering attempts that could lead to exploitation—see training.saintynet.com.
- Backup and Recovery: Maintain secure, offline backups of critical systems to mitigate ransomware or system tampering.
- Threat Intelligence Integration: Incorporate vulnerability feeds from trusted sources like CISA, MITRE, and Cybercory.com into your SOC workflows.
Conclusion:
CISA’s addition of these two vulnerabilities to the KEV catalog underscores a growing trend, industrial software is becoming a top target for cybercriminals. As attackers continue to exploit weak points in critical infrastructure and manufacturing platforms, swift action and continuous vigilance are vital.
Organizations that delay patching not only risk disruption but also jeopardize trust and operational safety. Whether in Washington, Dubai, or Johannesburg, the message is clear: stay updated, stay alert, and secure every link in your digital supply chain.
