Loading story…
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso, XWiki, and VMware Aria. The DELMIA Apriso platform is impacted by two severe flaws: a code injection vulnerability (CVE-2025-6204) that allows remote command execution, and a missing authorization issue (CVE-2025-6205) enabling privilege escalation. Both vulnerabilities have been actively exploited in attacks targeting manufacturing environments, with CISA urging immediate patching and network restrictions. XWiki, an open-source collaboration tool, is also under active exploitation due to an evaluation injection flaw (CVE-2025-24893) in the /bin/get/Main/SolrSearch endpoint, which allows unauthenticated remote code execution.
CISA's warning highlights the urgent need for organizations using these platforms to apply available patches and implement mitigation strategies. The inclusion of these vulnerabilities in the KEV catalog signals that they are being leveraged in real-world attacks, increasing the risk to unpatched systems. Security teams are advised to prioritize remediation efforts to prevent potential compromise and operational disruption.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2025-6204 and CVE-2025-6205 in Dassault Systèmes DELMIA Apriso, CVE-2025-24893 in XWiki, and CVE-2025-41244 affecting VMware Aria/VMware Tools to its Known Exploited Vulnerabilities catalog. The agency's action reflected active exploitation and triggered guidance for federal agencies to remediate the issues.
Dassault Systèmes reportedly patched the DELMIA Apriso missing authorization and privilege escalation vulnerability CVE-2025-6205 in August 2025. The flaw still posed risk to organizations that had not applied the fix across affected 2020–2025 releases.
The unauthenticated XWiki remote code execution vulnerability CVE-2025-24893 began being exploited in the wild in March 2025. Reported activity commonly involved attackers using the SolrSearch evaluation injection flaw to deploy cryptocurrency miners.
The VMware local privilege escalation flaw CVE-2025-41244 was reportedly exploited in the wild by China-linked threat actor UNC5174 starting at least in mid-October 2024. The issue stems from an untrusted search path weakness in a shell script used when VMware Tools is managed by Aria Operations with SDMP enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added a critical remote code execution vulnerability in Dassault Systèmes DELMIA Apriso (CVE-2025-5086, CVSS 9.0) to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The flaw, affecting versions 2020 through 2025, allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data. Federal agencies must patch by October 2, 2025, and all organizations are strongly urged to remediate immediately.
Jun 29, 2026
CISA has identified and added two actively exploited vulnerabilities in Dassault Systèmes' DELMIA Apriso software—CVE-2025-6204 (code injection) and CVE-2025-6205 (missing authorization)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws, affecting DELMIA Apriso releases from 2020 through 2025, allow attackers to execute arbitrary code and gain privileged access to unpatched systems, posing significant risks to organizations using this manufacturing operations management solution. CISA's Binding Operational Directive (BOD) 22-01 mandates that Federal Civilian Executive Branch agencies remediate these vulnerabilities by November 18, 2025, and strongly urges all organizations to prioritize patching to reduce exposure to cyberattacks. Dassault Systèmes released patches for both vulnerabilities in early August 2025 and confirmed their impact across multiple product versions. CISA emphasized that these types of vulnerabilities are frequent attack vectors for malicious actors and recommended applying vendor mitigations or discontinuing use if patches are unavailable. The agency also highlighted a previous critical DELMIA Apriso remote code execution flaw (CVE-2025-5086) added to the KEV Catalog in September, underscoring the ongoing threat to enterprises relying on this software for managing production, warehouses, and quality control operations worldwide.
Jun 29, 2026
CISA updated its **Known Exploited Vulnerabilities (KEV) Catalog** with additional vulnerabilities confirmed as exploited in the wild, reinforcing patch/mitigation urgency under **BOD 22-01** timelines. The KEV print catalog shows the addition of **CVE-2026-22769** affecting **Dell RecoverPoint for Virtual Machines (RP4VMs)**, described as a *use of hard-coded credentials* issue that could allow an **unauthenticated remote attacker** to gain unauthorized access to the underlying OS and establish **root-level persistence**; CISA’s entry points to Dell advisories/remediation guidance and third-party reporting on active exploitation. A corresponding update to CISA’s public *kev-data* repository reflects the routine publication of refreshed KEV data files and includes multiple KEV rows (e.g., **CVE-2024-7694** in *TeamT5 ThreatSonar Anti-Ransomware* for unrestricted file upload leading to command execution with admin privileges on the platform, and legacy items such as **CVE-2008-0015** in Microsoft Windows Video ActiveX Control). The KEV print view also lists other exploited items such as **CVE-2021-22175** in **GitLab** (SSRF when internal-network webhook requests are enabled), underscoring that the catalog update spans multiple vendors and vulnerability classes and should be treated as an operational patching priority.
Jun 29, 2026