Agiloft local privilege escalation via default credentials

published 2025-08-26 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-27849

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.

Patch / fix

fixed in 1

Agiloft Agiloft Release 30

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa vex VA-25-239-01 updated 2025-08-26 cvss 7.5

Agiloft multiple vulnerabilities

Agiloft <Release 30
affected: vendor fix
Agiloft Release 30
fixed: vendor fix wiki.agiloft.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 14 mo ago (2025-08-29)

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Agiloft Agiloft

Classification

Weakness

CWE-1392 Use of Default Credentials

References

wiki.agiloft.com /display/HELP/What%27s+New%3A+CVE+Resolution
release-notes, vendor-advisory
raw.githubusercontent.com /cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json
third-party-advisory
cve.org /CVERecord?id=CVE-2025-35114
third-party-advisory

Sources

CVE List CVE-2025-35114
NVD CVE-2025-35114

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary