CVE-2025-0089

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-00926.5In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could leaCVE-2025-00937.5In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lCVE-2025-01016.5A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes somCVE-2025-01038.8An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, suCVE-2025-01046.1A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript codeCVE-2025-01059.1An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files acceCVE-2025-01065.3A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesyCVE-2025-01079.8An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as tCVE-2025-01089.1An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the managementCVE-2025-01096.9An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attackerCVE-2025-01108.6A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the abilityCVE-2025-01116.5An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to
CVE-2025-0089: High severity, CVSS 7.8 | Vulnix