Loading story…
CISA has added a critical remote code execution vulnerability in Dassault Systèmes DELMIA Apriso (CVE-2025-5086, CVSS 9.0) to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. The flaw, affecting versions 2020 through 2025, allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data. Federal agencies must patch by October 2, 2025, and all organizations are strongly urged to remediate immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
6 references tracked. Mallory keeps watching after this page renders.
runzero.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has identified and added two actively exploited vulnerabilities in Dassault Systèmes' DELMIA Apriso software—CVE-2025-6204 (code injection) and CVE-2025-6205 (missing authorization)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws, affecting DELMIA Apriso releases from 2020 through 2025, allow attackers to execute arbitrary code and gain privileged access to unpatched systems, posing significant risks to organizations using this manufacturing operations management solution. CISA's Binding Operational Directive (BOD) 22-01 mandates that Federal Civilian Executive Branch agencies remediate these vulnerabilities by November 18, 2025, and strongly urges all organizations to prioritize patching to reduce exposure to cyberattacks. Dassault Systèmes released patches for both vulnerabilities in early August 2025 and confirmed their impact across multiple product versions. CISA emphasized that these types of vulnerabilities are frequent attack vectors for malicious actors and recommended applying vendor mitigations or discontinuing use if patches are unavailable. The agency also highlighted a previous critical DELMIA Apriso remote code execution flaw (CVE-2025-5086) added to the KEV Catalog in September, underscoring the ongoing threat to enterprises relying on this software for managing production, warehouses, and quality control operations worldwide.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso, XWiki, and VMware Aria. The DELMIA Apriso platform is impacted by two severe flaws: a code injection vulnerability (`CVE-2025-6204`) that allows remote command execution, and a missing authorization issue (`CVE-2025-6205`) enabling privilege escalation. Both vulnerabilities have been actively exploited in attacks targeting manufacturing environments, with CISA urging immediate patching and network restrictions. XWiki, an open-source collaboration tool, is also under active exploitation due to an evaluation injection flaw (`CVE-2025-24893`) in the `/bin/get/Main/SolrSearch` endpoint, which allows unauthenticated remote code execution. CISA's warning highlights the urgent need for organizations using these platforms to apply available patches and implement mitigation strategies. The inclusion of these vulnerabilities in the KEV catalog signals that they are being leveraged in real-world attacks, increasing the risk to unpatched systems. Security teams are advised to prioritize remediation efforts to prevent potential compromise and operational disruption.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding six new vulnerabilities that are currently being exploited in the wild. This update includes five vulnerabilities announced on October 14, 2025, and one additional vulnerability added on October 15, 2025. The vulnerabilities affect a range of widely used products, including Microsoft Windows, Rapid7 Velociraptor, SKYSEA Client View, IGEL OS, and Adobe Experience Manager. Among the most critical is CVE-2025-24990, an elevation of privilege flaw in the Agere Modem driver bundled with all Windows releases, which allows local attackers to gain SYSTEM-level access through untrusted pointer dereference. Microsoft addressed this issue by removing the vulnerable driver in the October 2025 Patch Tuesday update, though this may impact dependent hardware. Another significant vulnerability is CVE-2025-54253, a code execution flaw in Adobe Experience Manager Forms, which has been confirmed as actively exploited and poses a substantial risk to federal and enterprise environments. The Rapid7 Velociraptor vulnerability (CVE-2025-6264) involves incorrect default permissions, potentially allowing unauthorized access or privilege escalation. SKYSEA Client View is affected by an improper authentication vulnerability (CVE-2016-7836), while IGEL OS faces a risk from the use of expired cryptographic keys (CVE-2025-47827). Additionally, Microsoft Windows is impacted by an improper access control vulnerability (CVE-2025-59230). CISA’s KEV Catalog serves as a critical resource for tracking vulnerabilities that are confirmed to be exploited in real-world attacks, and federal agencies are mandated under Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by specified deadlines. CISA strongly encourages all organizations, not just federal agencies, to prioritize patching these vulnerabilities to reduce exposure to active cyber threats. The addition of these vulnerabilities underscores the ongoing risk posed by unpatched systems and the importance of timely remediation. CISA’s public alerts emphasize that these vulnerabilities are not theoretical and are being leveraged by malicious actors in current attack campaigns. The agency’s updates are based on evidence of active exploitation, highlighting the need for immediate action by security teams. Organizations are advised to consult the KEV Catalog regularly and integrate its findings into their vulnerability management processes. The removal of the Agere Modem driver by Microsoft demonstrates a decisive response to mitigate risk, though it may have operational impacts for some users. The inclusion of vulnerabilities across diverse platforms indicates that attackers are targeting a broad range of technologies. CISA’s ongoing updates to the KEV Catalog reflect its commitment to providing actionable intelligence to protect both federal and private sector networks. The agency’s guidance is clear: prompt remediation of known exploited vulnerabilities is essential to defend against active threats.
Jun 29, 2026