CVE-2025-53118

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-531197.5An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server.CVE-2025-531209.4A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server CVE-2025-531216.9Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on CVE-2025-531226.9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applicati CVE-2025-531318.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.CVE-2025-531327.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2025-531337.8Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-531347.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock CVE-2025-531357.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker CVE-2025-531365.5Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information loc CVE-2025-531377.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-531385.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over