CVE-2025-26817

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Netwrix Password Secure 9.2.0.32454 allows OS command injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 3, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-268189.8Netwrix Password Secure through 9.2 allows command injection.CVE-2025-268197.5Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.CVE-2025-26829.8A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the fCVE-2025-26839.8A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. This vulnerability affects unknown code ofCVE-2025-26849.8A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. This issue affects some uCVE-2025-268416.1Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.CVE-2025-268427.5An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visibCVE-2025-268449.8An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.CVE-2025-268459.8An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a CVE-2025-268469.8An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadaCVE-2025-268477.5An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.CVE-2025-268494.3There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt invento
CVE-2025-26817: Critical severity, CVSS 9.8 | Vulnix