CVE-2025-59459

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-59467.2Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Polle CVE-2025-594607.5The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting a CVE-2025-594619.8A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.CVE-2025-594627.5An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.CVE-2025-594637.5An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.CVE-2025-594647.5A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buff CVE-2025-594657.5A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` er CVE-2025-594667.5We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.crea CVE-2025-594679.6A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation CVE-2025-594689.1This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passwor CVE-2025-594699.0This vulnerability allows a Backup or Tape Operator to write files as root.CVE-2025-59479.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and