CVE-2025-35114
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-26

Last updated on: 2025-09-02

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-26
Last Modified
2025-09-02
Generated
2026-06-16
AI Q&A
2025-08-27
EPSS Evaluated
2026-06-15
NVD
CVE-2025-35114
EUVD
EUVD-2025-27849
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
atlassian agiloft From 19 (inc) to 30 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The vulnerability could allow an attacker to gain higher privileges on the affected system by exploiting default credentials and cracking password hashes offline. This local privilege escalation can lead to unauthorized access and control over the system.

Mitigation Strategies

Users should upgrade to Agiloft Release 30 to mitigate this vulnerability.

Executive Summary

This vulnerability exists in Agiloft Release 28, which contains several accounts with default credentials. At least one account's password hash is known and can be cracked offline. This situation could allow an attacker to escalate privileges locally by using these default or cracked credentials.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-35114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart