What is the CVSS score of CVE-2026-9695?

CVE-2026-9695 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of DELMIA Apriso are affected by CVE-2026-9695?

DELMIA Apriso (Release 2020-2026), Dassault Systèmes' manufacturing operations platform, contains a critical authentication bypass (CVSS 9.8) allowing unauthenticated remote attackers to gain full…

How to fix or mitigate CVE-2026-9695?

Within 24 hours: Implement network segmentation restricting Dassault Systèmes DELMIA Apriso administrative access to trusted internal networks only; enable multi-factor authentication for all administrative accounts; activate comprehensive audit logging on all DELMIA Apriso systems. Within 7 days: Contact Dassault Systèmes support to confirm which DELMIA Apriso releases (2020-2026) your organization operates and request interim mitigation guidance; audit all DELMIA Apriso instances to identify affected versions; conduct network-based penetration testing to assess exploitability from your external perimeter. Within 30 days: Monitor Dassault Systèmes security advisories daily for patch availability for DELMIA Apriso Releases 2020-2026; prepare and test business continuity runbooks for manual production operations; maintain offline encrypted backups of all DELMIA Apriso configurations and production data.

DELMIA Apriso CVE-2026-9695

EUVD-2026-42177 CRITICAL

Improper Authentication (CWE-287)

2026-07-08 3DS

GHSA-hx4w-2f46-xmmc

Authentication Bypass Delmia Apriso

9.8

CVSS 3.1 · Vendor: 3DS

Severity by source

Vendor (3DS) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Improper authentication grants unauthenticated network access to a privileged server session with no user interaction and full C/I/A impact, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (3DS).

CVSS VectorVendor: 3DS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 07:21 vuln.today

DescriptionCVE.org

An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.

AnalysisAI

Authentication bypass in Dassault Systèmes DELMIA Apriso (Release 2020 through Release 2026) lets remote unauthenticated attackers obtain privileged access to the manufacturing operations server, consistent with the CVSS PR:N/UI:N metrics. Rated CVSS 9.8 (C:H/I:H/A:H), it exposes shop-floor and production-control functions to full compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

DELMIA Apriso is Dassault Systèmes' Manufacturing Operations Management (MOM/MES) platform used to orchestrate production, quality, warehouse, and maintenance processes on the factory floor. The flaw is classified CWE-287 (Improper Authentication), meaning the application fails to correctly verify a caller's identity before granting access - typically a broken login/session or trust-boundary check an attacker can satisfy without valid credentials. The single CPE (cpe:2.3:a:dassault_systèmes:delmia_apriso) confirms the affected component is the Apriso application server itself rather than a bundled third-party library, and the wide 2020-2026 release span indicates a long-standing weakness in the authentication layer.

RemediationAI

Apply the fixed release identified in the Dassault Systèmes 3DS security advisory (https://www.3ds.com/trust-center/security/security-advisories/cve-2026-9695); no exact fixed version is stated in the available data, so treat patch status as 'Patch available per vendor advisory' and confirm the precise build with 3DS support before scheduling maintenance. Until patched, reduce exposure by removing DELMIA Apriso web interfaces and APIs from direct internet reachability and placing them behind a VPN or IP allowlist restricted to trusted plant/OT management networks (trade-off: may disrupt remote or supplier integrations that depend on external connectivity). Add reverse-proxy/WAF rules and monitor authentication logs for anomalous privileged sessions or logins that bypass expected credential flows; these are detective/compensating controls only and do not remove the underlying authentication bypass.