Loading story…
Dassault Systèmes disclosed two high-severity stored cross-site scripting vulnerabilities, CVE-2025-10551 and CVE-2025-10553, affecting Document Management in ENOVIA Collaborative Industry Innovator and Factory Resource Management in DELMIA Factory Resource Manager. Both flaws impact 3DEXPERIENCE releases from R2023x through R2025x and could let an authenticated attacker inject malicious content that executes arbitrary script code in another user's browser session.
The vulnerabilities are classified as CWE-79 and carry the same CVSS v3.1 vector, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, indicating network-based exploitation with low attack complexity, required low privileges, and user interaction. Vendor references point to Dassault Systèmes security advisories, and the impact profile highlights potential compromise of confidentiality and integrity within affected browser sessions.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On March 31, 2026, CVE entries were published documenting CVE-2025-10551 and CVE-2025-10553, including CVSS v3.1 scoring, CWE-79 classification, and references to Dassault Systèmes security advisories. Both vulnerabilities could allow arbitrary script execution in a user's browser session.
Dassault Systèmes received a report of CVE-2025-10553 on March 31, 2026. The issue is a stored XSS vulnerability in Factory Resource Management in DELMIA Factory Resource Manager affecting 3DEXPERIENCE releases R2023x through R2025x.
Dassault Systèmes received a report of CVE-2025-10551 on March 31, 2026. The flaw is a stored XSS vulnerability in Document Management in ENOVIA Collaborative Industry Innovator affecting 3DEXPERIENCE releases R2023x through R2025x.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has identified and added two actively exploited vulnerabilities in Dassault Systèmes' DELMIA Apriso software—CVE-2025-6204 (code injection) and CVE-2025-6205 (missing authorization)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws, affecting DELMIA Apriso releases from 2020 through 2025, allow attackers to execute arbitrary code and gain privileged access to unpatched systems, posing significant risks to organizations using this manufacturing operations management solution. CISA's Binding Operational Directive (BOD) 22-01 mandates that Federal Civilian Executive Branch agencies remediate these vulnerabilities by November 18, 2025, and strongly urges all organizations to prioritize patching to reduce exposure to cyberattacks. Dassault Systèmes released patches for both vulnerabilities in early August 2025 and confirmed their impact across multiple product versions. CISA emphasized that these types of vulnerabilities are frequent attack vectors for malicious actors and recommended applying vendor mitigations or discontinuing use if patches are unavailable. The agency also highlighted a previous critical DELMIA Apriso remote code execution flaw (CVE-2025-5086) added to the KEV Catalog in September, underscoring the ongoing threat to enterprises relying on this software for managing production, warehouses, and quality control operations worldwide.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso, XWiki, and VMware Aria. The DELMIA Apriso platform is impacted by two severe flaws: a code injection vulnerability (`CVE-2025-6204`) that allows remote command execution, and a missing authorization issue (`CVE-2025-6205`) enabling privilege escalation. Both vulnerabilities have been actively exploited in attacks targeting manufacturing environments, with CISA urging immediate patching and network restrictions. XWiki, an open-source collaboration tool, is also under active exploitation due to an evaluation injection flaw (`CVE-2025-24893`) in the `/bin/get/Main/SolrSearch` endpoint, which allows unauthenticated remote code execution. CISA's warning highlights the urgent need for organizations using these platforms to apply available patches and implement mitigation strategies. The inclusion of these vulnerabilities in the KEV catalog signals that they are being leveraged in real-world attacks, increasing the risk to unpatched systems. Security teams are advised to prioritize remediation efforts to prevent potential compromise and operational disruption.
Jun 29, 2026
Dassault Systèmes disclosed **CVE-2026-7858**, a critical deserialization of untrusted data flaw affecting **No Magic Teamwork Cloud** and **Magic Collaboration Studio** that can enable **unauthenticated remote code execution**. The vulnerability carries a **CVSS score of 9.8** and impacts Teamwork Cloud from **No Magic Release 2022x through 2026x** and Magic Collaboration Studio from **CATIA Magic Release 2022x through 2026x**, including Teamwork Cloud **Standard, Business, Business Pro, and Enterprise** editions. Reporting on the disclosure said successful exploitation could give attackers full remote takeover of exposed corporate modeling environments over the network without authentication. Organizations were urged to apply vendor updates immediately and reduce exposure by removing vulnerable servers from the public internet and enforcing network segmentation until remediation is complete.
Jun 29, 2026