CVE-2025-68825

HighCVSS 7.5/10Last modified Oct 7, 2026

Description

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
HCLSoftware	HCL Hive	1.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131731

Timeline

Published: Aug 24, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-68836.3A vulnerability classified as critical was found in code-projects Staff Audit System 1.0. This vulnerability affects unknown code of the fil CVE-2025-688335.3HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access t CVE-2025-688347.5Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-s CVE-2025-688357.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matiskiba Ravpage ravpage allows Refle CVE-2025-688367.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markbeljaars Table of Contents Creator CVE-2025-688376.5Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticke CVE-2025-688387.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discor CVE-2025-688397.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Theme Options easy-th CVE-2025-68848.8A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown p CVE-2025-688407.1Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.CVE-2025-688417.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack CVE-2025-688427.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalbounty Widget Logic Visual widget