Dassault Systèmes

Vulnerability activity for Dassault Systèmes: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 6
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 8
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 9
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.1CriticalOct 28, 2025Dassault Systèmes DELMIA Apriso Auth bypass / access controlCVE-2025-6205Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.Added to KEV Oct 28, 2025Exploited74% likelyExploit codeNucleiDetection
8.0HighOct 28, 2025Dassault Systèmes DELMIA Apriso Code / command injectionCVE-2025-6204Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.Added to KEV Oct 28, 2025Exploited79% likelyExploit codeNucleiDetection
9.0CriticalJun 2, 2025Dassault Systèmes DELMIA Apriso DeserializationCVE-2025-5086Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.Added to KEV Sep 11, 2025 · 100 days after publicationExploited97% likelyExploit codeNucleiDetection

Recent

7.1HighOct 12, 2026Dassault Systèmes Tuleap Enterprise Edition SQL injectionCVE-2026-105412An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.
8.1HighOct 12, 2026Dassault Systèmes Tuleap Enterprise Edition Auth bypass / access controlCVE-2026-105411An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.
8.7HighOct 12, 2026Dassault Systèmes Tuleap Enterprise Edition XSSCVE-2026-105410A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
8.7HighOct 12, 2026Dassault Systèmes Tuleap Enterprise Edition XSSCVE-2026-105409A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
8.7HighOct 12, 2026Dassault Systèmes Tuleap Enterprise Edition XSSCVE-2026-105408A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
8.8HighOct 12, 2026Dassault Systèmes Tuleap Enterprise Edition Code / command injectionCVE-2026-105407An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.1.8% likely
9.9CriticalSep 29, 2026Dassault Systèmes GEOVIA Geospatial Data Manager Code / command injectionCVE-2026-84154A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
8.8HighSep 21, 2026Dassault Systèmes Tuleap Enterprise Edition Code / command injectionCVE-2026-84285An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
7.5HighJul 13, 2026Dassault Systèmes Tuleap Enterprise Edition Auth bypass / access controlCVE-2026-14165An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.
9.1CriticalOct 28, 2025Dassault Systèmes DELMIA Apriso Auth bypass / access controlCVE-2025-6205Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.Exploited74% likelyExploit codeNucleiDetection
8.0HighOct 28, 2025Dassault Systèmes DELMIA Apriso Code / command injectionCVE-2025-6204Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.Exploited79% likelyExploit codeNucleiDetection
9.0CriticalJun 2, 2025Dassault Systèmes DELMIA Apriso DeserializationCVE-2025-5086Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.Exploited97% likelyExploit codeNucleiDetection

See every Dassault Systèmes entry on the dashboard.