Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack

XWiki Platform contains an eval injection flaw (CWE-95) that allows any unauthenticated guest user to execute arbitrary code on the hosting server. An attacker triggers the flaw by sending a crafted request to the platform's SolrSearch functionality, which evaluates attacker-controlled input without authentication. Successful exploitation yields arbitrary remote code execution with the privileges of the wiki application, potentially enabling full server compromise. Any deployment of XWiki Platform is affected, with internet-exposed wikis at the highest risk; the affected version ranges are not specified in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-30, indicating confirmed in-the-wild exploitation (ransomware use unconfirmed), and EPSS assigns a ~99.9% probability of exploitation within 30 days.

Do: Upgrade to a patched XWiki Platform release per the vendor's security advisory (fixed version numbers not provided in the available data); as interim mitigation, restrict untrusted access to the SolrSearch endpoint and review access logs for anomalous search requests and post-exploitation indicators such as unusual application-server child processes, new files, or webshells. The 2025-10-30 KEV listing makes remediation mandatory for U.S. federal agencies under BOD 22-01, and given the unauthenticated RCE with near-certain exploitation probability, internet-exposed wikis should be patched urgently.

CVE-2025-5086 is a deserialization of untrusted data flaw (CWE-502) in Dassault Systèmes DELMIA Apriso that can be reached over the network without privileges or user interaction, though with high attack complexity (CVSS 3.1 score 9.0). By feeding crafted serialized data to the application, an attacker can achieve remote code execution on the affected system, with high impact to confidentiality, integrity, and availability across scope. Any organization running DELMIA Apriso from Release 2020 through Release 2025 is in scope, including manufacturing execution deployments that expose the software to untrusted traffic. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-09-11, and SANS ISC has reported observed exploit attempts; the EPSS probability of exploitation within 30 days is 91.9%.

Do: Identify all DELMIA Apriso Release 2020 through Release 2025 deployments in your environment and upgrade to the patched releases specified in the Dassault Systèmes security advisory, as required by CISA KEV/BOD 22-01 guidance. Check whether any Apriso instances are internet-facing or reachable from untrusted networks, since SANS has observed active exploit attempts. If patching is not immediately possible, apply mitigations per vendor instructions or discontinue use of the product, and prioritize it given the 9.0 CVSS score and active exploitation.

CVE-2025-6205 is a missing authorization flaw (CWE-862) in Dassault Systèmes DELMIA Apriso, an enterprise manufacturing execution system (MES), affecting all releases from Release 2020 through Release 2025. Because required authorization checks are absent, a remote attacker can reach affected application functionality without any credentials or user interaction, as reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation allows the attacker to gain privileged access to the application, with high impact on confidentiality and integrity, earning a critical CVSS 3.1 score of 9.1. Any organization running DELMIA Apriso Release 2020 through Release 2025 is affected, typically manufacturers using Apriso to run plant-floor and production operations. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-28 amid reports of active exploitation, and EPSS assigns a 72.2% probability of exploitation within 30 days, though no public proof-of-concept is known.

Do: Apply the mitigations or updates specified in Dassault Systèmes' security advisory for all DELMIA Apriso deployments from Release 2020 through Release 2025, as required by CISA's KEV listing (federal agencies must follow BOD 22-01 timelines or discontinue use). Until patched, restrict network access to Apriso application servers and monitor for unauthenticated or unexpected privileged access to the application. Check vendor release notes for the exact fixed release applicable to your installed Apriso release, since the data here does not specify one.