CVE-2026-25112

HighCVSS 7.8/10Last modified Jul 24, 2026

Description

A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Genetec Inc.Genetec RabbitMQ<3.13.7.19
Genetec Inc.Genetec Mission Control<3.4.1.0
Genetec Inc.Genetec Sipelia<2.11
Genetec Inc.Genetec Industrial IoT<5.5.118.0; <6.0.196.0
Genetec Inc.Genetec Airport Operational Manager<1.6
Genetec Inc.Genetec Restricted Security Area<5.2.1
Genetec Inc.Genetec Inter-System Gateway<1.2

References

Timeline

Published
May 26, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-251139.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-251149.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-251159.9n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated useCVE-2026-251168.8Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulneCVE-2026-251178.3pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandCVE-2026-251187.5immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable tCVE-2026-251197.7Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the confiCVE-2026-25126.4The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and incCVE-2026-251202.7Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongsCVE-2026-251217.5apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vCVE-2026-251225.5apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drCVE-2026-251235.3Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and p
CVE-2026-25112: High severity, CVSS 7.8 | Vulnix