Cyber-Physical Systems (CPS) are composed by multiple subsystems that encompass numerous interdependencies. Although indispensable and highly performant from a functional perspective, complex interconnectivity constitutes paradoxically a significant vulnerability when an anomaly occurs. Anomalies could propagate and impact the entire CPS with irreversible consequences. This paper presents an approach to assess the anomaly propagation impact risk on a three layers oriented graph which represents the physical, digital, and system variables of a CPS components and interdependencies. Anomalies are detected applying information quality measures, while potential propagation paths are assessed computing the cumulated risk represented by weights assigned to the graph edges. To verify the cascading impact of different anomalies four cyber-attacks - denial of service, sensor offset alteration, false data injection, and replay attack - were implemented on a simulated naval water distribution CPS. The propagation impact of three anomalies was successfully assessed and the corresponding estimated propagation path, if applicable, confirmed.