Vulnerability Description
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Agiloft | >= 19, < 30 |
Related Weaknesses (CWE)
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/Third Party Advisory
- https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+ResolutionRelease NotesVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-35114Third Party Advisory
FAQ
What is CVE-2025-35114?
CVE-2025-35114 is a vulnerability with a CVSS score of 7.5 (HIGH). Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could...
How severe is CVE-2025-35114?
CVE-2025-35114 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-35114?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Agiloft.